DISM /Online /Cleanup-Image /RestoreHealth – Repair Corrupted Windows Images

The DISM /Online /Cleanup-Image /RestoreHealth command serves as one of Windows’ most powerful built-in repair tools, designed to fix corrupted system images from within the operating system. When Windows updates fail, applications crash unexpectedly, or system files become damaged, this command can often restore stability without requiring a full reinstallation. Understanding when and how to use it properly can save hours of troubleshooting and potential data loss.

Unlike simple troubleshooting utilities, DISM RestoreHealth targets the foundation of Windows functionality—the component store and WinSxS folder where critical system files reside. The command operates by replacing corrupted or missing files with clean versions pulled from either Windows Update servers or a local installation source. This makes it an essential tool for both routine maintenance and emergency recovery scenarios.

This guide covers the complete functionality of DISM /Online /Cleanup-Image /RestoreHealth, including proper execution syntax, common failure modes, and how it differs from other repair utilities. Whether working with Windows 10 or Windows 11, the information below applies to both consumer and server editions.

What Does DISM /Online /Cleanup-Image /RestoreHealth Do?

The DISM command, short for Deployment Image Servicing and Management, repairs the Windows component store—a protected area containing essential system files. When the /Online flag is added, the tool targets the running operating system’s image rather than an offline Windows file. The /Cleanup-Image parameter prepares the image for repair, while /RestoreHealth executes the actual restoration process by downloading clean copies of corrupted files from Windows Update.

Key Insights

• Repairs the component store before SFC can successfully replace system files
• Fetches replacement files from Windows Update servers by default
• Often resolves approximately 80-90% of system file corruption issues
• Microsoft recommends running DISM first, then SFC /scannow for complete repair
• The command modifies protected system files but does not affect personal data
• Works on both running operating systems and offline images
• Supported across Windows 10, Windows 11, and Windows Server editions

Quick Facts

How Do I Run DISM /Online /Cleanup-Image /RestoreHealth?

Running DISM RestoreHealth requires administrator privileges to access and modify protected system files. The process begins by opening an elevated Command Prompt or PowerShell window, which can be accomplished by right-clicking the Start button and selecting “Terminal (Admin)” on Windows 11 or “Command Prompt (Admin)” on Windows 10.

Standard Command Sequence

Microsoft recommends running commands in a specific sequence to ensure comprehensive diagnostics. First, use DISM /Online /Cleanup-Image /CheckHealth for a quick status check. This completes almost instantly and reports whether the image is healthy, repairable, or requires manual intervention. Next, run DISM /Online /Cleanup-Image /ScanHealth for a deeper examination—this scan may take several minutes and can report whether corruption was found and if repair is possible.

The actual repair command DISM /Online /Cleanup-Image /RestoreHealth should only be executed after these preliminary scans complete. The full restore operation downloads replacement files from Windows Update, which requires an active internet connection and can take anywhere from fifteen minutes to over an hour depending on system conditions.

Using an Offline Source

When Windows Update is inaccessible or unreliable, specifying a local source prevents the common error 0x800f081f (“The source files could not be found”). This approach requires a Windows installation media—either a USB drive or ISO file containing the same Windows version and edition as the installed system.

DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:E:\sources\install.wim:6 /LimitAccess

The /Source parameter points to the Windows Image file (WIM) located in the sources folder of installation media. The colon followed by a number indicates the specific image index—for example, “:6” references the sixth edition within the WIM file. The /LimitAccess flag prevents DISM from attempting to contact Windows Update if the local source fails, which can otherwise cause delays or additional errors.

Running in Safe Mode or Recovery Environment

If the standard Windows environment fails to complete DISM successfully, booting into Safe Mode or the Windows Recovery Environment provides a cleaner operating context. To enter Safe Mode, navigate to Settings > Recovery > Advanced startup and click “Restart now.” After the system restarts, select Troubleshoot > Advanced options > Command Prompt.

Alternatively, boot from a Windows installation USB drive and choose “Repair your computer” instead of proceeding with installation. From the Recovery Environment, run DISM commands against the attached installation media as the source. This method proves particularly valuable when corruption prevents normal Windows startup.

Why Does DISM RestoreHealth Fail and How to Fix It?

The most frequent DISM RestoreHealth failure occurs when the tool cannot locate the necessary replacement files. Error 0x800f081f, displaying the message “The source files could not be found,” indicates that neither Windows Update nor any specified local source could provide matching repair files. This typically happens when Windows Update is disabled, blocked by network configuration, or when the system image version does not align with available online sources.

Fixing Error 0x800f081f

The primary solution involves providing a matching Windows installation source. Download the Windows Media Creation Tool from Microsoft’s official website and create an ISO file matching your exact Windows version, edition, and build number. Mount the ISO or extract its contents, noting the drive letter assigned by Windows. Modify the DISM command to point toward the install.wim file within the sources folder.

Resolving Stuck or Hanging Processes

DISM RestoreHealth sometimes stalls at a specific percentage, commonly around 20%, for extended periods. This behavior typically indicates network timeout issues when pulling files from Windows Update, particularly on slower connections or during high-traffic periods. Patience remains advisable as the process may eventually complete, but extended stalls beyond thirty minutes often warrant intervention.

Running DISM /Online /Cleanup-Image /RestoreHealth /LimitAccess eliminates Windows Update as a fallback option, which can resolve hanging issues caused by the tool attempting multiple download sources. If this proves ineffective, switching to Safe Mode or the Recovery Environment eliminates background processes that might interfere with file replacement operations.

Running SFC Before DISM

Microsoft documentation recommends running sfc /scannow before attempting DISM RestoreHealth. While this might seem counterintuitive—the standard repair sequence is actually SFC followed by DISM followed by SFC again—the initial SFC run provides diagnostic information about system file integrity. Even if SFC reports no issues, the component store may still contain corruption that DISM can address.

After DISM completes successfully, running SFC /scannow a second time leverages the repaired component store to fix any remaining system file issues. This two-stage approach addresses both component-level corruption and individual file damage, producing more comprehensive results than either tool alone.

Checking CBS Logs

When troubleshooting persistent failures, examining the CBS.log file often reveals specific error causes. This log file resides at C:\Windows\Logs\CBS\CBS.log and records every operation performed by the Windows servicing stack, including detailed error codes and file references. Searching within the log for “Error” or the specific error code (such as “0x800f081f”) narrows results to relevant entries.

DISM RestoreHealth vs SFC /scannow: Key Differences

The System File Checker (SFC) and DISM RestoreHealth serve complementary purposes but operate at different levels of the Windows architecture. Understanding these differences guides proper tool selection and explains why both commands often appear in the same repair procedures.

SFC /scannow operates entirely from local files, comparing protected system files against a cached version within the Windows component store. When corruption exists at the component store level, SFC cannot locate valid replacement files and reports that it could not repair some files—despite finding no individual file errors.

DISM RestoreHealth addresses this limitation by downloading clean component store files from external sources, repairing the foundation upon which SFC depends. Once DISM completes successfully, the component store contains valid files that SFC can use for subsequent repairs.

Recommended Repair Sequence

Microsoft support documentation establishes a clear repair hierarchy: run sfc /scannow, then DISM /Online /Cleanup-Image /RestoreHealth, then sfc /scannow again. This three-step process addresses corruption at multiple levels—individual system files, component store integrity, and any remaining file-level issues after component repair.

For complete information about the System File Checker and its capabilities, see our comprehensive guide on difference between dementia and Alzheimer’s that covers repair utilities in broader context.

Is DISM /Online /Cleanup-Image /RestoreHealth Safe?

DISM RestoreHealth presents minimal risk to user data and installed applications. The command modifies only protected system files within the Windows component store and related directories. Personal documents, photos, videos, and application data stored outside these protected areas remain completely unaffected by the repair process.

File Safety Considerations

The tool operates exclusively on Windows system components, never scanning or modifying user-accessible directories by default. Temporary files can be safely deleted after repair completes—using built-in utilities like cleanmgr—without impact on the system’s stability. Manual deletion of files within the WinSxS folder, however, is strongly discouraged; the proper DISM cleanup commands exist specifically to manage this folder safely.

Duration and Performance Impact

The time required for DISM RestoreHealth varies considerably based on several factors. Systems with minimal corruption and reliable internet connectivity often complete the process in fifteen to thirty minutes. Heavily corrupted images without functional Windows Update access may require an hour or longer, particularly when using offline sources that must be read from disk rather than downloaded.

During execution, disk activity increases noticeably and system responsiveness may decrease slightly. Background applications can continue running, though performance in other tasks will suffer during active file downloads or disk reads. Scheduling the repair during low-usage periods or running it overnight prevents interference with productive work.

When Repair Might Be Unnecessary

DISM RestoreHealth addresses component store corruption, not all system issues. Hardware failures, driver conflicts, malware infections, and application-specific problems persist despite successful DISM operations. Running diagnostics to confirm that corruption actually exists within the component store prevents wasted time on unnecessary repairs.

Error 0x800f081f specifically indicates source unavailability rather than necessarily confirming corruption. If Windows Update installs successfully after the error occurs, the underlying corruption may have resolved through other mechanisms. Only when update failures, blue screen errors, or application crashes persist should DISM RestoreHealth be considered essential rather than precautionary.

Step-by-Step Timeline of a Typical DISM RestoreHealth Session

1. Open Administrator Command Prompt — Right-click Start, select Terminal (Admin) or Command Prompt (Admin), confirm UAC prompt
2. Run preliminary health check — Execute DISM /Online /Cleanup-Image /CheckHealth to verify image status (completes in seconds)
3. Execute deep scan — Run DISM /Online /Cleanup-Image /ScanHealth to identify repairable corruption (may take 5-15 minutes)
4. Execute restore command — Run DISM /Online /Cleanup-Image /RestoreHealth, monitoring progress bar (typically 15-60 minutes)
5. Complete follow-up SFC scan — Run sfc /scannow to repair remaining system file issues using the restored component store
6. Restart system — Reboot to apply changes and verify stability

What Works and What Remains Uncertain

Background and Context

The DISM tool originated as a component management utility for Windows deployment scenarios, initially appearing in Windows PE (Preinstallation Environment) and Windows Server deployment tools. Its inclusion as a standard Windows utility reflects Microsoft’s recognition that component store corruption represents a significant source of system instability.

Common triggers for component store corruption include interrupted Windows Updates, sudden power loss during servicing operations, disk errors affecting system partitions, and software that modifies protected Windows files. Systems experiencing frequent blue screen errors, application crashes during startup, or Windows Update failure repeatedly often benefit most from DISM RestoreHealth execution.

The relationship between DISM and SFC reflects an architectural evolution in Windows system repair. Older Windows versions relied primarily on SFC for all system file repairs, but modern Windows architecture separates file-level repairs (handled by SFC) from component-level repairs (handled by DISM), enabling more granular and reliable restoration.

Official Documentation and Guidance

Use the /RestoreHealth option to repair the corrupt component store using Windows Update as the source. If the operation fails, you can try specifying the /Source option with the location of the files that are required to repair the image.

— Microsoft Windows Image Repair Documentation

Run System File Checker (SFC.exe) to repair corrupted or missing system files. If the SFC command is unable to repair the files, the CBS.log file contains details about the files that could not be restored.

— Microsoft System File Checker Documentation

Next Steps After Running DISM RestoreHealth

Completing DISM RestoreHealth successfully establishes a healthy component store, but additional steps ensure comprehensive system repair. The immediate follow-up action involves running SFC /scannow to leverage the restored component files for fixing any remaining corrupted system files. This secondary scan often completes more quickly than the initial attempt would have before DISM repair.

After rebooting from the SFC scan, examine Event Viewer for any remaining errors in the System log. Persistent errors after both DISM and SFC completion suggest issues beyond file corruption—hardware problems, driver conflicts, or application-specific issues that require different remediation approaches.

If system instability continues despite successful DISM and SFC operations, consider System Restore to a point before corruption appeared, an in-place upgrade using the Windows Media Creation Tool, or Reset PC while preserving files. These options address corruption that has spread beyond the component store into other system areas.

For detailed information about common Windows errors and their resolution, see our guide on why certain tools carry specific risk profiles that contextualizes system repair within broader troubleshooting practices.

Frequently Asked Questions