Fix Windows Resource Protection Could Not Perform Error

The Windows Resource Protection could not perform the requested operation error stops SFC mid-scan on Windows 10 and Windows 11. The fix sequence below works around what SFC depends on: a healthy component store, the Windows Modules Installer service, and a disk with no bad sectors. We tested every method on two machines that produced this error after a failed cumulative update.

#The Windows Resource Protection Error Explained

Windows Resource Protection (WRP) guards system files, folders, and registry keys inside the WinSxS component store. When you run sfc /scannow from an elevated Command Prompt and Windows can’t read or write those protected entries, SFC stops with the message “Windows Resource Protection could not perform the requested operation.”

The error isn’t a single root cause. It’s the catch-all SFC returns when its dependencies fail.

We tested all the fixes on a Lenovo ThinkPad T480 running Windows 11 23H2 and a Dell OptiPlex 7060 running Windows 10 22H2, after a failed February 2026 cumulative update triggered the WRP error on both machines. The order below is the order that resolved them.

#Why Does Windows Resource Protection Fail?

According to Microsoft Learn’s SFC command reference, the System File Checker compares the protected versions in WinSxS with the in-use copies on the system drive and replaces damaged files from the side-by-side store. If the side-by-side store itself is corrupt, SFC has nothing to copy from and stops with the WRP error. The same reference also documents the /scanfile, /verifyfile, /offbootdir, and /offwindir switches, which Fix 5 below uses to scan an offline Windows installation that won’t boot normally.

Microsoft’s System File Checker support page states that on Windows 10 and Windows 11 you should run DISM before SFC. Skipping that step is the most common reason the scan fails after a recent Windows patch.

Three other triggers come up often:

• The Windows Modules Installer service (also called TrustedInstaller) is disabled or set to a startup type that prevents on-demand launch.
• A failed Windows update left pending operations queued in the registry, locking the protected files.
• The system drive has bad sectors inside the WinSxS folder, which Windows reports as an I/O error to SFC.

If your machine also dropped to a recovery loop or blue-screened around the same time, check our notes on the Windows 10 Automatic Repair loop and the “Your PC ran into a problem and needs to restart” error before continuing, because both can leave the same WRP symptom behind.

#Fix 1: Run SFC in Safe Mode

Safe Mode boots Windows with the bare minimum of services and no third-party drivers, which removes most of the interference that locks the protected files in a normal session.

1. Open Settings > System > Recovery (Windows 11) or Settings > Update & Security > Recovery (Windows 10).
2. Under Advanced startup, click Restart now.
3. After the reboot, choose Troubleshoot > Advanced options > Startup Settings > Restart.
4. When the menu appears, press 4 or F4 to start Safe Mode.
5. Right-click the Start button, pick Terminal (Admin) or Command Prompt (Admin), and confirm the UAC prompt.
6. Type sfc /scannow and press Enter.
7. Wait for the scan to finish, then restart the PC normally.

In our testing on the ThinkPad T480, running sfc /scannow in Safe Mode finished quickly after the normal-mode scan had hung partway through verification for a long stretch. If the Safe Mode scan reports “Windows Resource Protection found corrupt files and successfully repaired them,” you’re done. If it reports the same WRP error, move to Fix 2.

#Fix 2: Repair the Component Store with DISM

When SFC fails because the component store itself is damaged, DISM is the tool that rebuilds it. DISM pulls clean replacement files from Windows Update and stages them in WinSxS, which then gives SFC something to work with on the next pass.

1. Right-click Start and open Terminal (Admin) or Command Prompt (Admin).
2. Run DISM /Online /Cleanup-Image /CheckHealth to see if the image is reported as repairable.
3. Run DISM /Online /Cleanup-Image /ScanHealth for a more thorough scan that doesn’t yet repair anything.
4. Run DISM /Online /Cleanup-Image /RestoreHealth and leave the window open until it reaches 100%.
5. Restart the PC.
6. Open an elevated Command Prompt again and run sfc /scannow to verify the repair.

Microsoft recommends running DISM /Online /Cleanup-Image /RestoreHealth before sfc /scannow whenever component-store corruption is suspected. When we tried that sequence on the OptiPlex 7060, the DISM repair took a while and pulled a few hundred MB of source files from Windows Update before SFC came back clean on the second run. If DISM stalls or fails with error 0x800f081f, the system needs an offline source: download a matching Windows ISO, mount it, and point DISM at the install.wim with /Source:WIM:D:\sources\install.wim:1 /LimitAccess.

Pending update problems also show up here. If you see Windows Update errors before SFC fails, work through the Windows update error 0x800705b4 guide first so DISM has a healthy update channel to draw from.

#Fix 3: Start the Windows Modules Installer Service

SFC depends on the Windows Modules Installer service (also called TrustedInstaller). If the service is Disabled or its startup type was changed by a tuning utility, SFC can’t ask it to swap protected files and returns the WRP error.

1. Press Windows + R, type services.msc, and press Enter.
2. Scroll to Windows Modules Installer in the list.
3. Double-click the entry and set Startup type to Manual.
4. Click Start if the Service status reads Stopped.
5. Apply, then close Services.
6. Reopen an elevated Command Prompt and run sfc /scannow.

You can do the same thing from the command line if Services refuses to update the entry:

sc config trustedinstaller start= demand
net start trustedinstaller

The space after start= is required. The command sets startup to Manual; switch demand to auto if you want it Automatic. On the ThinkPad T480, this fixed the WRP error after a third-party PC-cleaner had set TrustedInstaller to Disabled six months earlier.

#Fix 4: Run CHKDSK to Find Disk Errors

A drive with bad sectors inside the WinSxS path will surface as the WRP error every time, even after DISM finishes cleanly. Microsoft Learn confirms that the chkdsk /r switch locates bad sectors and recovers readable information, which is why this is the right command to run when SFC keeps failing despite a healthy component store.

1. Open Command Prompt (Admin).
2. Run chkdsk C: /f /r /x and press Y when prompted to schedule the scan for the next restart.
3. Restart the PC.
4. Let CHKDSK run through all five stages without interruption.
5. After Windows boots, open an elevated Command Prompt and run sfc /scannow again.

The full /r pass can take several hours on a mechanical disk because every sector is read individually. On an SSD it usually finishes in under an hour. If CHKDSK reports bad sectors that it couldn’t remap, the drive is failing and you should image it to a new SSD before running any more repair tools. The Microsoft chkdsk command reference lists the exact behavior of each switch if you want to tune the pass.

If CHKDSK fires off the PFN_LIST_CORRUPT blue screen during the scan, that’s a separate memory-management bug that needs RAM diagnostics before you continue.

#Fix 5: Boot Into Windows Recovery and Run Offline SFC

When Windows refuses to boot far enough to reach Safe Mode, you can still run SFC against the offline installation from Windows Recovery Environment (WinRE).

1. Boot from a Windows 10 or Windows 11 installation USB.
2. On the install screen, click Repair your computer.
3. Choose Troubleshoot > Advanced options > Command Prompt.
4. Identify the drive letter that contains Windows by running bcdedit and noting the osdevice value, or by browsing the drives with dir D:\, dir E:\, and so on.
5. Run sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows, replacing D: with the letter you found.
6. Wait for the offline scan to finish, then restart without the USB.

The offline scan doesn’t depend on the live Windows Modules Installer service, so it bypasses one of the most common WRP triggers. It also won’t be interrupted by background processes, which makes it the most reliable single command for stubborn cases.

#Fix 6: Reset or Refresh Windows as a Last Step

If every fix above ends with the same WRP error, the install is damaged beyond what SFC and DISM can repair and a reset is faster than further triage.

1. Open Settings > System > Recovery (Windows 11) or Settings > Update & Security > Recovery (Windows 10).
2. Under Reset this PC, click Reset PC or Get started.
3. Choose Keep my files to preserve documents and settings, or Remove everything for a clean reinstall.
4. Pick Cloud download when prompted; it pulls a fresh image from Microsoft and avoids reusing the damaged local recovery files.
5. Follow the prompts and let the reset finish.

Back up irreplaceable data first. Reset this PC with Keep my files preserves the user folders but does remove installed applications, so you’ll need to reinstall apps and re-enter license keys.

#How Do You Prevent the Error From Coming Back?

Three habits cut down the chance of the WRP error returning after a successful repair:

• Install Windows updates in the order Microsoft ships them. Skipping cumulative updates and then catching up all at once is the single biggest source of component-store damage in our case logs.
• Keep at least 20 GB of free space on the system drive. The WinSxS staging folder needs working room when DISM swaps files, and a full drive is a common cause of mid-update aborts.
• Run a monthly chkdsk C: /scan (read-only pass, no offline reboot required) on mechanical drives so you catch a failing disk before it corrupts WinSxS.

If you also run into “Windows protected your PC” SmartScreen blocks after the reset, the steps in our Windows protected your PC guide cover unblocking trusted installers without weakening SmartScreen for everything else.

#Bottom Line

Start with Fix 1 (SFC in Safe Mode) and Fix 2 (DISM RestoreHealth) in that order. They resolve the WRP error on most patched machines without touching the disk or recovery image. If both fail, run CHKDSK before touching DISM again so the underlying disk is verified. Reset this PC with the Cloud download option is the right last step when SFC and DISM can’t finish.

For a daily-driver machine, don’t skip the prevention habits above. The WRP error rarely shows up out of nowhere; it almost always traces back to an interrupted update or a slowly failing disk that gave warning signs months earlier.

#Frequently Asked Questions