The following describes the System File Checker tool (Sfc.exe) that is used with the Windows File Protection (WFP) feature.
The System File Checker tool gives an administrator the ability to scan all of the protected files to verify their versions. The System File Checker tool also checks and repopulates the

%SystemRoot%\System32\Dllcache folder.

System File Checker (SFC) checks and verifies that all system files are where they should be as they were by default and not corrupted, changed, or damaged. If so it is possible to repair and restore the integrity of the system files .
In Vista, when SFC runs, it logs it's actions to the C:\WINDOWS\LOGS\CBS\CBS.LOG. You can find the specific SFC entries by searching for the [SR] tags in the log.

If the Dllcache folder becomes damaged or unusable, you can use either the sfc /scanonce or sfc /scanboot command to repair the contents of the folder.

To run Windows 2000 System File Checker,

1. Click Start,
2. Click Run,
3. Type sfc /scannow (or one of the other options described below), and then click OK.

• The /scannow command scans all protected system files and replaces incorrect versions with correct Microsoft versions.
  This command also repopulates the DLLCache folder with the most recent versions of protected files. This requires access to the Windows installation source files and also the installed Service Pack files. You are usually prompted for the location of these files during the scan operation.
• The /scanonce command scans all protected system files once. This command requires access to the Windows installation source files.
• The /scanboot command scans all protected system files every time that you start your computer. This command requires access to the Windows installation source files.
• The /cancel command cancels all pending scans of protected system files.
• The /enable command enables WFP for normal operation.
• The /purgecache command purges the file cache and scans all of the protected system files immediately. This command requires access to the Windows installation source files. This command is required after you run the /cachesize=x command.
• The /cachesize=x command sets the file cache size in megabytes (MB). This command requires a reboot followed by a /purgecache command to adjust the size of the on-disk cache.
• The /quiet command replaces all incorrect file versions without prompting the user.

The SfcScan value in the following registry key has three possible settings:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

• 0x0 = do not scan protected files after restart. (Default value)
• 0x1 = scan all protected files after every restart (set if sfc /scanboot is run).
• 0x2 = scan all protected files one time after a restart (set if sfc /scanonce is run).

The above applies to:

• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Datacenter Server
• Microsoft Windows 2000 Professional
• Microsoft Windows 2000 Server