"Windows Resource Protection found corrupt files"

hbenthow · 06 Dec 2020

I am running Windows 1909 (Build 18363.1198).

My computer is a Dell OptiPlex 9020 Mini Tower. Today, I restarted it, but when I was logging back into Windows, I was met by a "setup wizard" style screen with some options. I clicked to dismiss it, and was able to see my desktop, which was normal as if nothing had happened. However, during the restart and for a few minutes after logging in, my computer seemed slower and more sluggish than usual.

I decided to run sfc /scannow and dism /online /cleanup-image /restorehealth to see if anything was wrong, and got the following results:

Microsoft Windows [Version 10.0.18363.1198](c) 2019 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannowBeginning system scan. This process will take some time.

Beginning verification phase of system scan.

Verification 100% complete.

Windows Resource Protection found corrupt files and successfully repaired them.For online repairs, details are included in the CBS log file located atwindir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offlinerepairs, details are included in the log file provided by the /OFFLOGFILE flag.

C:\Windows\system32>dism /online /cleanup-image /restorehealthDeployment Image Servicing and Management toolVersion: 10.0.18362.1139

Image Version: 10.0.18363.1198

[==========================100.0%==========================]

The restore operation completed successfully.

The operation completed successfully.

Take special notice to the part that I highlighted in bold text.I'm not sure how to find the /OFFLOGFILE file, but here's CBS.log:Dropbox - CBS.log - Simplify your life

I then ran sfc /scannow again, and got these results:

Microsoft Windows [Version 10.0.18363.1198](c) 2019 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannowBeginning system scan. This process will take some time.

Beginning verification phase of system scan.

Verification 100% complete.

Windows Resource Protection did not find any integrity violations.C:\Windows\system32>

This seems to show that the problems were fixed. Still, I want to know what was wrong. What are the problems that were found? Were they serious?

Bree · 06 Dec 2020

hbenthow said:

This seems to show that the problems were fixed. Still, I want to know what was wrong. What are the problems that were found? Were they serious?

Correct. Everything was fixed. None of the problems were actual corrupt files, they were all to do with a directory's ownership or security permissions being set twice. This was not a serious problem and in any case has now been fixed. These were the relevant entries in your CBS.log.

Code:

2020-12-06 17:46:07, Info                  CSI    0000008f Warning: Overlap: Directory \??\C:\Windows\System32\drivers\en-US\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
2020-12-06 17:46:07, Info                  CSI    00000090 Warning: Overlap: Directory \??\C:\Windows\System32\wbem\en-US\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
2020-12-06 17:46:07, Info                  CSI    00000091 Warning: Overlap: Directory \??\C:\Windows\help\mui\0409\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
...
2020-12-06 17:54:11, Info                  CSI    000001dc Warning: Overlap: Directory \??\C:\Windows\SysWOW64\drivers\en-US\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
2020-12-06 17:54:11, Info                  CSI    000001dd Warning: Overlap: Directory \??\C:\Windows\SysWOW64\wbem\en-US\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
2020-12-06 17:54:11, Info                  CSI    000001de Warning: Overlap: Directory \??\C:\Windows\help\mui\0409\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
...
2020-12-06 17:55:17, Info                  CSI    0000021c Warning: Overlap: Directory \??\C:\Program Files (x86)\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-shell32, version 10.0.18362.1171, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-shell32, version 10.0.18362.1171, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
2020-12-06 17:55:17, Info                  CSI    0000021d Warning: Overlap: Directory \??\C:\ProgramData\Microsoft\Windows\Start Menu\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-shell32, version 10.0.18362.1171, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-shell32, version 10.0.18362.1171, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
2020-12-06 17:55:17, Info                  CSI    0000021e Warning: Overlap: Directory \??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-shell32, version 10.0.18362.1171, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-shell32, version 10.0.18362.1171, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
2020-12-06 17:55:17, Info                  CSI    0000021f Warning: Overlap: Directory \??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-shell32, version 10.0.18362.1171, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-shell32, version 10.0.18362.1171, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}

Take special notice to the part that I highlighted in bold text.I'm not sure how to find the /OFFLOGFILE file...

There isn't one, that is only generated when you run SFC to repair an offline system (ie. a system on another drive that isn't the one you are running Windows from). You repaired the online system (the one you were running) and the only log generated would be CBS.log.

hbenthow · 07 Dec 2020

Bree said:

Correct. Everything was fixed. None of the problems were actual corrupt files, they were all to do with a directory's ownership or security permissions being set twice. This was not a serious problem and in any case has now been fixed. These were the relevant entries in your CBS.log.There isn't one, that is only generated when you run SFC to repair an offline system (ie. a system on another drive that isn't the one you are running Windows from). You repaired the online system (the one you were running) and the only log generated would be CBS.log.

Thank you.

zbook · 07 Dec 2020

1909 support ends May 2021.

Upgrading is an additional method that can fix ownership.

Code:

Products Released	Lifecycle Start Date	Mainstream Support End Date	Extended Support End Date	Service Pack

Windows 10, version 1909 (Home, Pro, Pro Education, Pro for Workstations)	11/12/2019	5/11/2021	Review Note	


This Semi-Annual Channel is governed by the Modern Lifecycle Policy.

See the Windows Lifecycle FAQ and Windows as a Service (WaaS) for details regarding servicing requirements and other important information.

Unless deferred, subsequent Windows 10 Semi-Annual Channel feature updates may be installed prior to the listed end of Mainstream Support date.

Bree · 07 Dec 2020

hbenthow said:

Thank you.

You're welcome.

The CBS.log contains a lot besides the SFC results and can be confusing to read 'raw'. Option Five in this tutorial tell you how to filter it for the SFC entries for corrupt files that were fixed, or that couldn't be fixed (in which case you'd need to run DISM, then SFC again).

Run SFC Command in Windows 10

But in your case it showed that there was no corruption. The only other thing SFC reports are these double ownership/permissions. They are not a significant error and would have caused no problems. In all cases I've seen reported the entries were correct, just duplicated.

As zbook says, an upgrade to the next version of Windows would also have corrected them.