How to analyze SFC /scannow logs

By -
Sfc /scannow will inspect all of the important Windows files on your computer, including Windows DLL files. If System File Checker finds an issue with any of these protected files, it will replace it.
You can find the sfc logs inside CBS.log under C:\Windows\logs\CBS\ folder.
There will be a lot of entries in cbs logs. You can filter out the log for SFC by running the below command.

 findstr /c:"[SR]" cbs.log > sfcdetails.txt

The above command will search for the string [SR] and if it found , then it copies the corresponding entry in to the sfcdetails.txt

Below is sample text extracted from CBS log by using the above command
-----------------------------------------------------------------------------------------------------------
2013-06-24 12:55:44, Info                  CSI    00000210 [SR] Verify complete
2013-06-24 12:55:44, Info                  CSI    00000211 [SR] Verifying 100 (0x00000064) components
2013-06-24 12:55:44, Info                  CSI    00000212 [SR] Beginning Verify and Repair transaction
2013-06-24 12:55:48, Info                  CSI    00000214 [SR] Verify complete
2013-06-24 12:55:48, Info                  CSI    00000215 [SR] Verifying 100 (0x00000064) components
2013-06-24 12:55:48, Info                  CSI    00000216 [SR] Beginning Verify and Repair transaction
2013-06-24 12:55:53, Info                  CSI    00000218 [SR] Verify complete
2013-06-24 12:55:54, Info                  CSI    00000219 [SR] Verifying 88 (0x00000058) components
2013-06-24 12:55:54, Info                  CSI    0000021a [SR] Beginning Verify and Repair transaction
2013-06-24 12:55:57, Info                  CSI    0000021c [SR] Verify complete
2013-06-24 12:55:57, Info                  CSI    0000021d [SR] Repairing 1 components
2013-06-24 12:55:57, Info                  CSI    0000021e [SR] Beginning Verify and Repair transaction
2013-06-24 12:55:57, Info                  CSI    00000220 [SR] Cannot repair member file [l:24{12}]"PhotoAcq.dll" of Microsoft-Windows-PhotoAcquire, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-06-24 12:55:57, Info                  CSI    00000222 [SR] Cannot repair member file [l:24{12}]"PhotoAcq.dll" of Microsoft-Windows-PhotoAcquire, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch2013-06-24 12:55:57, Info                  CSI    00000223 [SR] This component was referenced by [l:178{89}]"Microsoft-Windows-PhotoBasicPackage~31bf3856ad364e35~x86~~6.1.7600.16385.PhotoBasicUpdate"
2013-06-24 12:55:57, Info                  CSI    00000226 [SR] Could not reproject corrupted file [ml:520{260},l:82{41}]"\??\C:\Program Files\Windows Photo Viewer"\[l:24{12}]"PhotoAcq.dll"; source file in store is also corrupted
2013-06-24 12:55:57, Info                  CSI    00000228 [SR] Repair complete
2013-06-24 12:55:57, Info                  CSI    00000229 [SR] Committing transaction
2013-06-24 12:55:57, Info                  CSI    0000022d [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction  have been successfully repaired
---------------------------------------------------------------------------------------------------------------------------------

From the above log you can see that there are only entries with [SR] line which is generated by sfc. There are some entries by sfc where sfc cannot repair some of the dll files which is highlighted above. Here in this case PhotoAcq.dll was not repaired by sfc. We can resolve this issue by copying the same dll file from a working machine and replacing it.

In few cases you may have to copy the file into C:\Windows\winsxs or C:\Windows\servicing, where you may not have permission to copy the file. You can take ownership and give full permission to the location by running the below commands.

takeown /f C:\Windows\winsxs\folder or file name where you want to take ownership

icacls C:\Windows\winsxs\folder or file name  /grant Administrators:F

Comments

Post a Comment

Popular posts from this blog

Boot configuration Data Store --BCDEdit /set

By -
The  BCDEdit /set  command sets a boot entry option value in the Windows boot configuration data store (BCD). Use the  BCDEdit /set  command to configure specific boot entry elements, such as kernel debugger settings, data execution protection (DEP) and processor address extension (PAE) options, and to load alternate hardware abstraction layer (HAL) and kernel files. You can use these boot entry options when you are testing and debugging your driver for Windows Vista, Windows 7, and later versions of Windows. bcdedit /set [{ID}] datatype value Parameters [ { ID }] The  { ID }  is the GUID that is associated with the boot entry. If you do not specify an  { ID } , the command modifies the current operating system boot entry. If a boot entry is specified, the GUID associated with the boot entry must be enclosed in braces  { } . To view the GUID identifiers for all of the active boot entries, use the  bcdedit /enum  command. datatype value The fol
Read more

ADSI Edit

By -
Image
ADSI Edit (adsiedit.msc) Updated: March 19, 2010 Applies To: Windows SBS 2008, Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2, Windows Server 2008, Windows Server 2008 R2 Active Directory® Service Interfaces Editor (ADSI Edit) is a Lightweight Directory Access Protocol (LDAP) editor that you can use to manage objects and attributes in Active Directory. ADSI Edit (adsiedit.msc) provides a view of every object and attribute in an Active Directory forest. You can use ADSI Edit to query, view, and edit attributes that are not exposed through other Active Directory Microsoft Management Console (MMC) snap-ins: Active Directory Users and Computers, Active Directory Sites and Services, Active Directory Domains and Trusts, and Active Directory Schema. This topic includes the following sections: Installing ADSI Edit Using ADSI Edit
Read more

Userenv logging (User Environment logging)

By -
When you enable userenv logging, you can perform debug logging of the user profile and the system policy processes. Userenv log files also contain information about the status of each Group Policy extension, such as Application Deployment, Security, and Folder Redirection. Userenv log files reveal what is occurring in the background as a user logs on   Userenv.log file located in the %SystemRoot%\Debug\UserMode folder Userenv log files contains information about the following: Group Policy settings that are not processed or not applied as expected Folder redirection that does not occur Profile or registry hive load, unload, or deletion failures Logon script, or script not applied as expected Default behaviors occurring because a slow link was detected Roaming profile issues Slow logon issues Whether a given GPO is accessible, and if not, why access was denied. The name of the domain controller that is accessing SYSVOL. The Userenv log has a maximum size of 1 megabyt
Read more