Prevent SFC and DISM Automatic Repairs

Sheikh · Jun 29, 2026

Hi everyone!

I'm working on another highly customized version of Windows, and I want to prevent both automatic SFC and DISM repair operations, as they would restore the original system files and overwrite my modifications.

I also want to block users from running SFC and DISM repair commands manually. What would be the best way to achieve this?

joeandmarg0 · Jun 29, 2026

Disconnect from the internet or use Linux.

Sheikh · Jun 29, 2026

joeandmarg0 said:
Disconnect from the internet or use Linux.

So, you think SFC won't work without internet? :))))

dalchina · Jun 29, 2026

Presumably with the customisation choice you've made, you will have Windows update completely disabled.

As for blocking specific exe files, as you have Pro, consider using Group Policy:

Note: all customisations I've made are done specifically so as not to have implications for repairs, updates or upgrades.
I use Vista icons, pastel backgrounds, translucent titlebars, Open Shell with a Win 7 Orb, and of course a taskbar arranged as per Win 10.

pseymour · Jun 29, 2026

The best way to prevent users from running DISM and SFC is to just not give them admin rights. Second best, I guess, would be to deny them access to the executables by adding a deny entry to the ACL for each.

garlin · Jun 29, 2026

Remove WinSXS. Problem solved!

But seriously, if you're afraid that a component-based repair will clobber the DLL files you've replaced on the filesystem, then you must be afraid of getting Monthly Updates. Because those can introduce patched files, which may end up overwriting your custom files.

A better solution is to keep track of the handful of DLL files you're replacing, and have a script to copy those files back from a backup folder.

Marie SWE · Jun 29, 2026

Sheikh said:
Hi everyone!

I'm working on another highly customized version of Windows, and I want to prevent both automatic SFC and DISM repair operations, as they would restore the original system files and overwrite my modifications.

I also want to block users from running SFC and DISM repair commands manually. What would be the best way to achieve this?

Hi there

When i modify files and i dont want the system to repair, i change the permission on that file so system/trusted installer dont have write access to them, i also set it as write protected(if it is a file that only are used for read/run) If i remove files and i dont want the system to restore/reinstall it, i create a ghost-file that is write protected and the system/trusted installer dont have any permission to it.
If you then run dism it will give errors as you just locked out the system.

Marie SWE · Jun 29, 2026

joeandmarg0 said:
Disconnect from the internet or use Linux.

I know..... I see that you agree that Linux is way better then Windows 10/11 home/pro. :wink:

pseymour · Jun 29, 2026

Wonder if we can get the eye roll emoji added as a reaction.

Marie SWE · Jun 29, 2026

pseymour said:
Wonder if we can get the eye roll emoji added as a reaction.

You can always use the wow and then reply with a smily rolling its eyes.

I have a feeling you saw i was sarcastic/ironic in my linux quote. :wink:

joeandmarg0 · Jun 30, 2026

Reference post 3.
Neither dism nor sfc are automatic.,they are started via Terminal.
Disconnecting from the Internet is to provide a stable platform if you intend to mess around with registry modification.
Reference post 10.
Suggesting Linux was because tampering with the registry there is common practice.
Your attempt at sarcasm is misplaced.

Sheikh · Thursday at 2:42 AM

For additional context, I have completely disabled Windows Update, and I don't want to restrict file permissions because I want advanced users to retain full control over modifying system files.

My goal is simply to disable the SFC and DISM commands entirely. Replacing files with a script is not a viable solution, as some files need to be modified during future processes. Likewise, changing file permissions is not an option because I want users to have full access.

Based on the replies so far, it appears that Microsoft does not provide an official way to disable these commands. It seems I will have to come up with some unconventional workaround to achieve the same result.

At least, is there any way to prevent automatic repair? for example disabling a default scheduled task.

dalchina · Thursday at 3:06 AM

Have you not considered the group policy option in my post #4? That seems pretty 'official' to me..!

Oh, and given your emphasis on a fixed, non-updated build that would be wrecked by standard repair methods, you are of course routinely using 3rd party disk imaging so as to restore it when things go wrong or should your disk fail e.g.

Marie SWE · Thursday at 10:04 AM

dalchina said:
Have you not considered the group policy option in my post #4? That seems pretty 'official' to me..!

Oh, and given your emphasis on a fixed, non-updated build that would be wrecked by standard repair methods, you are of course routinely using 3rd party disk imaging so as to restore it when things go wrong or should your disk fail e.g.

I know from 10Forums you are pretty deep in to windows if i remember right.

from post 14: ((( My goal is simply to disable the SFC and DISM commands entirely. )))
I dont have a windows computer in front of me and i trashed my test-VM.. sfc and dism is those two tied to exe files, or is it just system commands?

dalchina · Thursday at 10:17 AM

Yes, they are .exe files

Here's a different approach which might work for those (note the caveat in the video).

Not a 'nice' method, but possible in Home too.

And of course there's Applocker

AppLocker

This article provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker policies.

learn.microsoft.com

E.g. 1 of the related Applocker tutorials:

Allow or Block Executable Files with AppLocker in Windows 11

This tutorial will show you how to use AppLocker to create a rule to allow or block executable (.exe and .com) files to run for all or specific users and groups in Windows 10 and Windows 11. AppLocker is included in Local Security Policy (secpol.msc) to configure Application Control Policies in...

www.elevenforum.com

Prevent SFC and DISM Automatic Repairs

Software Developer

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Software Developer

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

tomato soup and grilled cheese

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

tomato soup and grilled cheese

My Computer My Computer

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Software Developer

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer