sfc will not complete in normal mode but will in safe mode...

[midgo]

I can never successfully run the sfc /scannow command on my machine except in safe mode for some reason.
sfc/verifyonly works.
DISM commands work fine.
I have never been able to work out why this is...


sfc normal mode...


sfc safe mode...


DISM Normal...


I have tried almost everything that is available on searches of the internet including off line boot commands for sfc.
I get the could not start the repair service on these attempts.
Any thoughts appreciated...

 

[philc43]

Would this have anything to do with the Antivirus interfering in some way?

 

[midgo]

I am only using windows defender.
No other antivirus or anti malware...

 

[krzemien]

Out of interest here: what does CBS.log file contain in case of failures?

This log can be found here:

C:\Windows\Logs\CBS

Also, does SFC scan completes (100%) but merely indicates that it cannot do something - as per the message?

 

[midgo]

Image of latest scan done right now is attached.
It does complete to 100%.
Then shows "Windows Resource protection could not complete the requested operation.
I have attached the CBS.log file...

 

[krzemien]

Thanks - am looking into this as I see errors, obviously.

Quick ones:

1. For how long you encountered this problem? (I assume very long time)
2. Is this the latest Windows 10 20H2 release with latest CU Jan '21 installed? (I assume: yes judging by the info through another forum)
3. What version of Windows 10 this PC started from? (I think 1511 if not before)


EDITED TO ADD:

I also think it will be beneficial to run ICACLS across few places on your HDD either:

C:\WINDOWS\System32\drivers\en-US
C:\WINDOWS\System32\wbem\en-US
C:\WINDOWS\help\mui\0409
C:\ProgramData\Microsoft\Windows\Start Menu
C:\WINDOWS\SysWOW64\drivers\en-US
C:\WINDOWS\SysWOW64\wbem\en-US
C:\WINDOWS\help\mui\0409
C:\Program Files (x86)
C:\ProgramData\Microsoft\Windows\Start Menu

Please re-run SFC /SCANNOW once you update the above and supply fresh CBS.LOG

 

[midgo]

Hi
Thanks for the assistance.
1.Quite a while, exact time uncertain.
2.Yes latest version. I did an in place upgrade using the MCT tool with the latest ISO yesterday successfully.
3.Again probably as I haven't done a clean install for a while.


I ran ICACLs on all the suggested files/folders.
All were successful except...

C:\WINDOWS\system32>icacls C:\Program Files (x86)
Invalid parameter "Files"
C:\WINDOWS\system32>icacls C:\ProgramData\Microsoft\Windows\Start Menu
Invalid parameter "Menu"
C:\WINDOWS\system32>icacls C:\ProgramData\Microsoft\Windows\Start Menu
Invalid parameter "Menu"

Again SFC /SCANNOW was unsuccessful.
I have attached the requested files.

 

[midgo]

Further...
I tried sfc /verify only in normal mode just now and that works.
It says there are integrity violations but when I do sfc /scannow in safe mode there are no problems

 

[krzemien]

Thanks very much.

In the meantime I did verify on my PC that exactly the same issues reported by this tool with some folders' ownership, as per this example:

2021-01-20 10:33:17, Info                  CSI    000001d1 Warning: Overlap: Directory \??\C:\Program Files (x86)\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-shell32, version 10.0.19041.746, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-shell32, version 10.0.19041.746, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}

do also exist on my PC and do not seem to be resolved by running ICACLS. So putting aside relability of this tool's response (or lack of it) best to ignore them.

Having said that, the only issue remaining in your latest CBS.LOG now - previous package errors are surprisingly gone? - is here:

2021-01-20 10:32:59, Error                 CSI    0000016e@2021/1/19:23:32:59.345 (F) onecore\base\wcp\sil\ntsystem.cpp(756): Error STATUS_ACCESS_DENIED originated in function WorkAroundBackupIntentForFilesystem expression: NtOpenFile
[gle=0x80004005]
2021-01-20 10:32:59, Info                  CBS    Could not get active session for current session file logging [HRESULT = 0x80004003 - E_POINTER]
2021-01-20 10:32:59, Info                  CBS    Could not get file name for current session file logging [HRESULT = 0x80004003 - E_POINTER]
2021-01-20 10:32:59, Info                  CBS    Added C:\WINDOWS\Logs\CBS\CBS.log to WER report.
2021-01-20 10:32:59, Info                  CBS    Not able to add pending.xml to Windows Error Report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2021-01-20 10:32:59, Info                  CBS    Not able to add pending.xml.bad to Windows Error Report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2021-01-20 10:32:59, Info                  CBS    Not able to add SCM.EVM to Windows Error Report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2021-01-20 10:32:59, Info                  CSI    0000016f [SR] Repairing file \??\C:\WINDOWS\System32\\SearchIndexer.exe from store

It does actually look like file access error to me - which could explain why SFC in SafeMode returns no problems.

Can you find matching WER report on your PC to see if there's any more information we could use - although I'm not sure it was created judging by the above?

WER reports are saved here:

C:\ProgramData\Microsoft\Windows\WER

and here:

C:\Users\YOUR_USER_NAME\AppData\Local\Microsoft\Windows\WER

But I would expect to find in the first location.

 

[krzemien]

[snip]
I ran ICACLs on all the suggested files/folders.
All were successful except...

C:\WINDOWS\system32>icacls C:\Program Files (x86)
Invalid parameter "Files"
C:\WINDOWS\system32>icacls C:\ProgramData\Microsoft\Windows\Start Menu
Invalid parameter "Menu"
C:\WINDOWS\system32>icacls C:\ProgramData\Microsoft\Windows\Start Menu
Invalid parameter "Menu"

Moot point now - as per my above repsonse - but this is because you should have put these paths into the "" marks, for example: icacls "C:\ProgramData\Microsoft\Windows\Start Menu".

Also, I gather this command should also have been executed with /T flag to ensure this fix propagates in all subfolders.

But let's ignore this inconsistency for the time being.

 

[krzemien]

Few additional questions:

1. What are the particulars of SearchIndexer.exe file on your PC? It's here: C:\WINDOWS\System32 and mine's details below:

​

2. Does your Windows Search (Indexing) work as expected?


Services:

​

Control Panel:

​

 

[midgo]

I seem to be unable to access the WER folder due to access denied.
I have tried changing the security details but to no avail.
I have attached my copies of the 3 screen and there seem to be issues with search.







Looks like there a issues here as well:///

 

[krzemien]

Thanks. You - as a user - are Administrator with full rights, I suppose?

If so, then there's definitive problem with access rights on your PC which needs addressing - probably in Safe Mode either.

Having said that: I think it's worth running some 3rd Party AV and - more importantly - malware (Malwarebytes or similar) scan on your PC as the above could be indicative of something creepy going on there.

 

[midgo]

Thanks. You - as a user - are Administrator with full rights, I suppose?

If so, then there's definitive problem with access rights on your PC which needs addressing - probably in Safe Mode either.

Having said that: I think it's worth running some 3rd Party AV and - more importantly - malware (Malwarebytes or similar) scan on your PC as the above could be indicative of something creepy going on there.

Yes I am the administrator.
I have run a Malwarebytes threat scan and found nothing...
Can I fix these access rights in safe mode or???

 

[krzemien]

Thanks. Yes, I guess it's best to be performed - in this case - in Safe Mode to ensure there's nothing that block files access and such refresh is successful.

Alas! I've never performed such action myself and although - I'm guessing - it's either to run icacls in the root folder and let it do the job (including all sub-folders), or using something of that sort:

Tweaking.com - Windows Repair Free/Pro

See also here for reference:

Is there a utility to reset all W10 permissions back to defaults? - Windows 10 Help Forums

I cannot vouch for the ultimate results however, but in your case I think it's still worth trying (and before you do anything: you do have the latest backup etc., correct?).

 

[midgo]

Thanks for you ongoing interest and suggestions.
Yes I have tried the methods you refer to above including using windows repair and UVK in safe mode as suggested in the articles which appears to reset items stated but with no success I'm afraid.
At some stage I will have to do a clean install to correct these issue I'm having.
For now as long as DISM is successful in normal mode and sfc works in safe mode I am reasonably happy to continue as is.
Thanks again...

 

[zbook]

1) Please download and install to the desktop Windows 10 20H2:

Download Windows 10

2) Uninstall any of these non-Microsoft software:
a) antivirus
b) firewall
c) drive encryption

3) Place the computer into clean boot:
Perform a Clean Boot in Windows 10 to Troubleshoot Software Conflicts

4) Perform an in place upgrade repair:
Repair Install Windows 10 with an In-place Upgrade

5) After the in place upgrade repair run:

a) Tuneup.bat - Click here to go to the BSOD batch repository to download and run this batch file.

b) SetupDiag - Windows Deployment | Microsoft Docs

 

[midgo]

1) Please download and install to the desktop Windows 10 20H2:

Download Windows 10

2) Uninstall any of these non-Microsoft software:
a) antivirus
b) firewall
c) drive encryption

3) Place the computer into clean boot:
Perform a Clean Boot in Windows 10 to Troubleshoot Software Conflicts

4) Perform an in place upgrade repair:
Repair Install Windows 10 with an In-place Upgrade

5) After the in place upgrade repair run:

a) Tuneup.bat - Click here to go to the BSOD batch repository to download and run this batch file.

b) SetupDiag - Windows Deployment | Microsoft Docs

Thanks for these suggestions.
I have already done 1. 2. 3 and 4 previously with no success.
I will try 5 on it's own and see if it changes anything.
Otherwise I will start from 1 and do them all again.
I will advise the outcome as soon as possible.
Thanks again...

 

[midgo]

Thanks for these suggestions.
I have already done 1. 2. 3 and 4 previously with no success.
I will try 5 on it's own and see if it changes anything.
Otherwise I will start from 1 and do them all again.
I will advise the outcome as soon as possible.
Thanks again...

Here are the 1st Tune Up scan results...

The setup diag report was blank???

 

[zbook]

First and second scannow:

Windows Resource Protection could not perform the requested operation.

Please run:
LOGS.bat - Click here to go to the BSOD batch repository to download and run this batch file.
SysnativeBSODCollectionApp | Sysnative Forums