“Windows Resource Protection could not start the repair service” stops System File Checker before it can repair your system files. The repair depends on Windows Modules Installer, also called TrustedInstaller, to change protected files. Start with administrator access and the service settings, then move to component repair or reinstallation if the error persists.
Run SFC with administrator access
Search for Command Prompt in Windows. Then right-click Command Prompt and select Run as administrator.
Approve the permission prompt. Enter sfc /scannow and press Enter. Administrator access is required, but it cannot fix a disabled or damaged repair service by itself.
Start Windows Modules Installer
This addresses a disabled or stopped TrustedInstaller service. Press Windows+R to open Run, then enter services.msc and press Enter.
Open Windows Modules Installer. Set Startup type to Manual. Select Apply.
Select Start if the service is stopped. Run sfc /scannow in your administrator Command Prompt.
Prefer commands? As an alternative to Services, run sc.exe config trustedinstaller start= demand in an administrator Command Prompt. Keep the space after start=; demand sets the service to Manual.
Run net start trustedinstaller, then run sfc /scannow again. You only need one of these service configuration methods. If the service fails to start, record the exact error message before continuing to DISM.
Repair the Windows component store with DISM
DISM repairs the Windows component store when servicing files are damaged. Microsoft recommends running it before SFC. It normally gets repair files through Windows Update.
On Windows 11, check for updates through Start > Settings > Windows Update > Check for updates. On Windows 10, use Start > Settings > Update & Security > Windows Update > Check for updates. Update availability depends on servicing eligibility.
Install the applicable updates, then restart your PC after installation. In an administrator Command Prompt, run DISM.exe /Online /Cleanup-Image /RestoreHealth. Let it finish successfully before continuing, then run sfc /scannow.
If DISM fails or the service error remains, use the offline repair steps below when working in recovery. If Windows still starts, move to the repair reinstall section.
Target the installed Windows copy in recovery
For an error in Windows Recovery Environment, target the installed Windows copy with offline SFC. To enter recovery from Windows, hold Shift while selecting Power > Restart. Select Troubleshoot > Advanced options > Command Prompt.
Confirm the actual offline boot directory and Windows directory before running SFC. Recovery assigns drive letters independently, so Windows does not necessarily use C:. Plain sfc /scannow does not specify the offline installation.
Run sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows only if D:\ is the correct boot directory and D:\Windows is the correct Windows directory. Otherwise, substitute the actual locations. If offline SFC cannot complete, obtain a compatible repair source for offline DISM. Its files must match the installation sufficiently, including the servicing level and languages.
Run DISM /Image:D:\ /Cleanup-Image /RestoreHealth /Source:E:\RepairSource\Windows, replacing D:\ with the actual Windows volume and E:\RepairSource\Windows with your repair-source directory. That example source is not supplied on your PC. Retry the offline SFC command after DISM finishes successfully. Remember that DISM’s /Image option targets an offline installation, while /Online targets the currently running environment.
Reinstall Windows while keeping apps and files
When Windows still starts, choose the Windows 11 repair option or run compatible installation media from inside Windows.
- 1.Back up your important data.
- 2.For the Windows 11 repair option, open Start > Settings > System > Recovery. Under Fix problems using Windows Update, select Reinstall now > OK. This preserves apps, files, and settings and requires the 2022 annual update or later plus the February 2024 optional update or later.
- 3.Keep power and internet connected during that repair, then restart when it finishes. If the option is missing, or you use Windows 10, take the installation-media route in the next two steps instead.
- 4.While signed in to Windows, connect compatible official installation media for your PC’s architecture and licensed edition. Open its setup.exe in File Explorer.
- 5.Select Yes, then Change what to keep > Keep personal files and apps > Next > Install. Proceed only if Setup offers that retention option. Start Setup inside Windows to retain installed apps.
- 6.After either repair installation finishes, run sfc /scannow in an administrator Command Prompt.
Reset Windows after other repairs fail
A reset is more disruptive than a repair reinstall. Keep my files preserves personal files but removes apps and settings. Save this option for when less disruptive repairs fail.
Back up your files before starting. On Windows 11, open Settings > System > Recovery > Reset PC. On Windows 10, open Settings > Update & Security > Recovery. Under Reset this PC on Windows 10, select Get started.
If Windows cannot start, access the reset through recovery’s Troubleshoot > Reset this PC instead. Choose Keep my files to retain personal files. Select Cloud download or Local reinstall. Cloud download is useful when local repair files are damaged.
Follow the reset prompts to complete reinstallation. If resetting fails, use a clean installation from official Windows media as the final recovery option. Back up your data first: a clean installation removes files, apps, and settings.
Frequently Asked Questions
Does TrustedInstaller need to be set to Automatic?
No. Manual, called demand in the sc.exe command, is sufficient for on-demand repair. Automatic is a valid setting, but it is not required.
Will Safe Mode fix this repair-service error?
Safe Mode is a diagnostic option, not a universal fix for this message. Microsoft specifically recommends it for the different SFC error “could not perform the requested operation.”
How do I get the BitLocker key requested by recovery?
Note the recovery key ID shown on the screen. On another device, visit https://aka.ms/myrecoverykey and sign in to the associated Microsoft account. Match the ID, then enter the corresponding 48-digit key on the locked PC. A saved printout or USB text file is another place to retrieve it. The key unlocks access to repair tools; it does not repair the service.
What should I do on a work or school PC?
Contact your administrator if you lack administrator access, the service cannot start, or DISM cannot obtain repair files. Repair-source locations and Windows Update access are configurable through organizational policy. Some devices with managed updates do not offer Windows 11’s repair reinstall through Windows Update.