Windows Resource Protection Could Not Start Repair Service

You open Command Prompt as administrator, run the command everyone recommends, and Windows answers with a sentence that sounds like the repair shop itself is broken:

Windows Resource Protection could not start the repair service.

Run these two lines in the same administrator window, then try the scan again: sc config trustedinstaller start= auto and then net start trustedinstaller. For most people that is the entire repair, and it takes under a minute.

Here is the part almost nobody tells you, and it changes how you read the whole message. SFC does not repair anything. It finds the damage, then hands the actual work to a separate service named TrustedInstaller — the only component in Windows permitted to touch protected system files. And Windows ships that service set to Manual, which means sitting there stopped is its normal, healthy state.

So the error is not telling you a repair service is broken. It is telling you a service that is supposed to be asleep refused to wake up. On the majority of machines, the reason it refused is not damage at all — it is that somebody, at some point, told it never to wake up again.

sc config trustedinstaller start= auto
net start trustedinstaller
sfc /scannow

The Tuesday Jake Billed a Customer for Nothing

Jake runs a phone and computer shop with two repair benches and a queue that never quite clears. A regular customer brought in a laptop that had been "cleaned up" by a nephew — slow shutdowns, Windows Update failing, Photos crashing on launch. Standard stuff. Jake did what he always does and started with the file checker.

It refused. Same sentence, every time, on an administrator prompt he had opened correctly.

He spent an hour and a half on it. He ran DISM and got error 87, which he read as confirmation that the machine was in worse shape than it looked. He tried a system restore point that did not exist. He quoted the customer $90 for a Windows reinstall and a data backup, and he started copying files off the drive.

Ethan called in the middle of it, heard the story, and asked one question: "Did you look at whether the service is disabled, or did you assume it was broken?"

It was disabled. The nephew had run a tune-up script off a video, and that script switched off Windows Modules Installer along with a dozen other things, because a lot of those lists treat it as "Windows Update bloat." Two commands and forty seconds later the scan ran clean. Jake refunded the $90 he had not yet earned, which he says still annoys him more than the ninety minutes.

"The insulting part," he told Ethan afterwards, "is that the error message names a thing that isn't the thing that failed."

He is right. And that is worth understanding properly, because it turns this error from a mystery into a checklist.

What the Error Is Actually Telling You

Windows Resource Protection is not a service. It is the feature — the umbrella name for the mechanism that keeps protected system files from being altered. When you run sfc /scannow, you are running a small command-line front end to that feature. It compares your system files against a set of known-good copies and builds a list of what is wrong.

Then it needs someone to do the replacing. That someone is Windows Modules Installer, whose service name is TrustedInstaller and whose executable lives at C:\Windows\servicing\TrustedInstaller.exe. It holds ownership of the protected files. Not your administrator account — if you have ever tried to delete something in C:\Windows and been told you need permission from TrustedInstaller, you have already met it.

So the chain is short and it breaks in an obvious place once you can see it:

Read that second row again, because it is the whole point. Manual is correct. Manual means the service starts when something asks for it and stops again afterwards, which is how it should behave. A stopped Windows Modules Installer is not evidence of anything. Disabled is the fault, and Disabled is almost always something a human chose.

The Two Commands, and How to Confirm They Worked

Do this from an elevated prompt. Press the Windows key, type cmd, then choose Run as administrator — if you need it spelled out, our walkthrough for running CMD as administrator covers every route including the ones that still work when the Start menu is misbehaving.

1. Set the service so it is allowed to start. Run sc config trustedinstaller start= auto. You want the reply [SC] ChangeServiceConfig SUCCESS. If a wall of usage text scrolls past instead, you typed start=auto without the space — that is a syntax rejection, not a fix.
2. Start it, and read the answer. Run net start trustedinstaller. Success looks like "The Windows Modules Installer service was started successfully." Anything else is a real signal, so note the wording before moving on.
3. Run the scan. sfc /scannow. Let it reach 100%. It can sit at a percentage for several minutes without being stuck, and interrupting it is genuinely a bad idea.
4. Put the service back where Windows had it. Once the scan completes, run sc config trustedinstaller start= demand. That restores the Manual default. Leaving it on Automatic is not dangerous, but there is no reason to keep a service running that is built to start on request.

If you would rather click than type, services.msc gets you to the same place. Press Windows+R, type services.msc, press Enter, and scroll to Windows Modules Installer. It sorts under W, by display name, not under T for TrustedInstaller — which is why people report the service is "missing" when it is sitting right there. Set Startup type to Manual or Automatic, click Start, then OK.

When It Says SUCCESS and the Scan Still Refuses

This is where most pages stop, and it is where a great many readers actually are. On Microsoft's own support thread for this error, hundreds of people report that the recommended service fix did not resolve it for them. They are not doing it wrong. They are hitting a different cause that wears the same error message.

The single most useful habit here is to stop treating "SUCCESS" as an outcome. sc config returning SUCCESS only means the startup type was written to the registry. It says nothing whatsoever about whether the service can start. That is what step 2 is for, and its reply is the piece of information that routes you:

Ethan's framing is worth borrowing: the error message is a symptom shared by five or six different illnesses, so the useful move is never "apply the famous fix harder." It is to make the machine tell you which illness you have. The table above is that question, asked in one command.

The msconfig Trap, and Why It Catches People Twice

There is a second route into this error that has nothing to do with tune-up scripts, and it catches careful people rather than careless ones.

If you have ever troubleshot a startup problem using msconfig — the System Configuration window — you may have set it to Selective startup or Diagnostic startup and cleared the box that loads system services. That is a legitimate diagnostic technique. The trap is that msconfig remembers. It is a switch, not a temporary mode, and it stays where you left it across every restart until you go back and change it. Plenty of machines have been sitting in Selective startup since a problem that was solved two years ago.

While Windows is in that state, the services required for repairs are held back, and sfc /scannow produces exactly the message on this page. Here is how to check and clear it:

1. Press Windows+R, type msconfig, and press Enter.
2. On the General tab, look at which option is selected. If it is anything other than Normal startup, that is very likely your answer.
3. Select Normal startup, then click Apply and OK.
4. Restart when prompted, then run sfc /scannow again from an administrator prompt.
5. If services still appear switched off afterwards, go back in, choose Selective startup, make sure both boxes are checked, open the Services tab, click Enable all, then Apply, OK and restart once more.

One honest warning about Enable all: on a machine that genuinely has unwanted software on it, this switches that software back on too. Use it to get the repair done, then go back and manage startup items deliberately from Task Manager rather than leaving msconfig holding things down.

Checking the Service Registration by Hand

If sc config refuses, or the service behaves as though the console and the system disagree about it, look at the registration directly. Registry work deserves a moment of care, so export a backup of the key before changing it — right-click the key, choose Export, and save it somewhere you can find again.

Open regedit as administrator and go to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustedInstaller

The value that matters is Start, a DWORD. It reads 2 for Automatic, 3 for Manual, and 4 for Disabled. If you find 4, that is your fault confirmed in writing — set it to 3 and restart. There should also be an ImagePath value pointing at C:\Windows\servicing\TrustedInstaller.exe. If that path is wrong, or the whole TrustedInstaller key is absent, the service has been unregistered rather than disabled, and no amount of switching will bring it back. That case is covered further down.

While you are here, it is worth glancing at the same Start value under the wuauserv key next door. The scripts that disable one almost always disable the other, and it explains why Windows Update has probably been silent as well.

Running the Scan Where Nothing Can Interfere

Safe Mode starts Windows with third-party services and drivers held back. That makes it the cleanest way to separate "Windows is damaged" from "something running on Windows is in the way," and it costs you one restart.

The F8 key has not opened this menu since Windows 7, so ignore any guide that tells you to hammer it. On Windows 11 and Windows 10, hold Shift while clicking Restart in the Start menu. From the blue screen that appears, choose Troubleshoot, then Advanced options, then Startup Settings, then Restart. When the numbered list appears, press 4 for Safe Mode or 5 if you want networking as well.

Once you are in, open an administrator Command Prompt and run sfc /scannow. If it completes here but fails during a normal start, you have your answer and it is not Windows — it is security software or a startup utility. Work out which one, and either configure an exclusion or run your repairs from Safe Mode as a matter of routine.

If Windows will not start at all, the same menu offers Command Prompt directly, and SFC can address an offline installation from there using sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows. Do check your drive letter first with diskpart or by listing directories, because the recovery environment frequently assigns different letters than the ones you see day to day.

DISM First, SFC Second — and the Truth About Error 87

When the service starts cleanly and SFC still fails, or SFC runs but reports files it could not repair, the problem has moved. SFC restores damaged files by copying clean versions out of a local store. If that store is damaged too, SFC has nothing good to copy from. Repairing the store is DISM's job, which is why the correct order when things are going badly is DISM first, SFC afterwards.

DISM /Online /Cleanup-Image /RestoreHealth

Give it time. It commonly appears frozen around 20 percent and then completes normally, and it needs a working internet connection because it pulls replacement files from Windows Update. When it finishes, run sfc /scannow again. Our companion guide on repairing corrupted system files with SFC and DISM takes that pairing much further, including what to do when DISM itself cannot find the sources it needs.

Now, error 87 — the one that convinced Jake his customer's laptop was beyond saving. It is worth knowing exactly what it is, because the wording invites the wrong conclusion:

A typo that presents itself as a fault is a genuinely expensive thing in a repair shop, and error 87 is the purest example of it in Windows. If you take one habit from this page, make it this: when a command tool reports an error, check that you typed it correctly before you conclude anything about the machine.

Reading the Log So You Stop Guessing

Once the scan runs, it writes what it did to a log — and that log is the difference between knowing and hoping. It is buried in a file large enough to be unpleasant to open, but one command pulls out only the lines you want and drops them on your desktop:

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

Open sfcdetails.txt and you get every System File Checker entry, each tagged SR, with timestamps and file names. Look for lines saying a file was repaired, and for lines saying one could not be. A file that cannot be repaired names itself, which turns an abstract problem into a specific one you can search for.

Two things to know before you read it. The file contains entries from every run of SFC that machine has ever done, so check the dates rather than assuming the top of the file is today. And "cannot repair member file" alongside a component name almost always points back at the component store rather than at the file itself, which puts you back on the DISM route above.

Ethan's line on this, which Jake now repeats to his own customers: the log is not advanced. It is just the only part of this process that tells the truth without being asked twice.

What This Page Said in 2016

This post first went up in March 2016, written after we hit the error on our own machine while changing settings we should probably have left alone. The fix we published was a fifteen-step walkthrough of msconfig: switch to Diagnostic startup, restart, switch back to Normal startup, restart again, and the scan runs.

That advice worked. It worked for a lot of people for a lot of years, and the comments said so. But it never explained why, and that turned out to matter more than we understood at the time.

What was really happening is the msconfig trap described above: services had been held back, and the round trip through Diagnostic and back to Normal reset the switch that was holding them. The steps were a way of flipping a setting without ever naming it. So the walkthrough cured the symptom for the readers whose cause was msconfig, and did nothing at all for the much larger group whose Windows Modules Installer had been disabled outright — a group that has grown a great deal since 2016, because "speed up Windows" scripts have grown a great deal since 2016.

The msconfig route is still on this page, because for some of you it is still the answer. It has just been moved to where it belongs: one cause among several, rather than the only door in the building. The 2016 version also sent readers to a post we have since retired, and that link is gone.

When Repairing Is the Wrong Answer

Three situations mean the repair tools have genuinely run out of road, and recognizing them early saves the afternoon Jake lost.

The service registration is gone. If sc query trustedinstaller reports that the specified service does not exist, and the registry key is absent too, there is nothing left to enable. A handful of aggressive debloat scripts delete registrations rather than disabling them.

DISM cannot repair the store even with a source. If /RestoreHealth fails against a mounted ISO of your exact build, the component store is beyond in-place repair.

SFC reports the same unfixable files after a clean DISM run. Two clean runs of the upstream tool and identical output downstream means the loop is closed.

In all three cases the next step is an in-place upgrade, not a reset and not a clean install. Download the Media Creation Tool from Microsoft, run the installer from inside your running Windows, and choose to keep personal files and apps. It replaces the entire system layer, including the service registrations and the component store, while leaving your programs, settings and files where they are. It takes about an hour and it is dramatically less painful than the reinstall most people jump to. A reset, by comparison, removes your installed applications — which is a real cost for a problem that an in-place upgrade fixes without charging it.

And before any of that, if the machine is otherwise working, ask the honest question: does this actually need fixing today? SFC failing on a healthy machine is a repair tool that is unavailable, not damage that is spreading. Getting the service back is usually forty seconds. Getting it back is not urgent enough to justify a reinstall you will regret.

Your Questions, Answered Straight

What does Windows Resource Protection could not start the repair service mean?

It means sfc /scannow found the damage but could not hand the repair job to the program that does the actual work. That program is a service called Windows Modules Installer, better known by its internal name TrustedInstaller. SFC is only the front end. When TrustedInstaller will not start, SFC has nothing to hand the work to, so it stops before it begins.

Which service does sfc /scannow actually need?

Windows Modules Installer, service name TrustedInstaller, running from C:\Windows\servicing\TrustedInstaller.exe. It is the component that owns the protected system files and is the only thing permitted to replace them. Open services.msc and look for the display name Windows Modules Installer rather than TrustedInstaller, because the console sorts by display name.

Is it a problem that Windows Modules Installer is set to Manual?

No. Manual is the correct default on both Windows 11 and Windows 10. The service is designed to sit stopped and start on demand when Windows Update, an optional feature install, or SFC asks for it. Seeing it stopped in services.msc is normal and is not the fault. The fault is Disabled, which blocks it from ever starting.

What is the fastest fix for this error?

Open Command Prompt as administrator and run sc config trustedinstaller start= auto followed by net start trustedinstaller, then run sfc /scannow again. For most people that is the whole repair and it takes under a minute. Afterwards you can set the service back to Manual with sc config trustedinstaller start= demand, which is where Windows had it.

Why does the space in start= auto matter?

Because sc.exe wants the space after the equals sign and none before it. start= auto works. start=auto returns a usage screen, and start =auto fails as well. This single space is behind a large share of the reports that say the documented fix did not work, because a usage screen scrolling past looks close enough to success that people move on.

The command said SUCCESS but SFC still fails. What now?

SUCCESS from sc config only confirms the startup type was written. It does not confirm the service started. Run net start trustedinstaller separately and read that result. If it reports error 1053, error 1067, or access denied, the service is being blocked rather than merely switched off, and third-party security software or a tune-up script is the usual reason.

What is DISM error 87 and how do I fix it?

Error 87 means DISM did not recognize an option you typed, and the overwhelming cause is a missing space. DISM /Online /Cleanup-Image /RestoreHealth works, while DISM /Online /Cleanup-Image/RestoreHealth returns error 87. Nothing is wrong with the machine when this appears. Check the spaces before each slash, then run it again.

Should I run DISM or SFC first?

DISM first when SFC is failing or reporting files it cannot repair. SFC replaces damaged files from a local store of known-good copies, so if that store is itself damaged, SFC has nothing clean to copy from. DISM RestoreHealth repairs the store. Run DISM, let it finish, then run sfc /scannow.

Can I run sfc /scannow without administrator rights?

No. Without elevation you get a different message telling you that you must be an administrator running a console session. If you are seeing the Windows Resource Protection could not start the repair service wording instead, elevation is not your problem and running as administrator again will not change anything.

Does Safe Mode help with this error?

Often, yes, and it is worth trying before anything drastic. Safe Mode starts Windows with third-party services and drivers held back, so security software and tune-up utilities are not there to interfere. If sfc /scannow completes in Safe Mode but fails during a normal start, you have identified the cause as something that loads with Windows rather than damage to Windows itself.

Windows Modules Installer is missing from services.msc entirely. What does that mean?

The service registration itself has been removed, which a few aggressive debloat scripts do. This is more serious than a disabled service because there is nothing left to enable. An in-place upgrade using the Media Creation Tool restores the registration while keeping your files and installed programs, and it is a far smaller job than a clean install.

Where can I see what SFC actually found and fixed?

In the CBS log. Run findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt" and open the text file that appears on your desktop. Every SFC entry is tagged SR, and the file lists each file examined along with whether it was repaired. It tells you more in a minute than another hour of guessing will.

Can a debloat or PC tune-up script cause this error?

Yes, and it is the most common cause we see behind this message. A great many optimization guides and scripts list Windows Modules Installer among the services to disable, on the reasoning that it is tied to Windows Update. Disabling it does stop updates, and it also removes the only component allowed to repair system files, so SFC stops working on the same day.

Can antivirus software cause this error?

It can. Security products guard the servicing folders closely, and a few block the service from starting rather than blocking a file. If net start trustedinstaller returns access denied while you are signed in as an administrator, temporarily pausing real-time protection and trying again is a reasonable diagnostic step. Turn it back on immediately afterwards either way.

What does SFC do when it finds a file it cannot repair?

It reports that it found corrupt files but was unable to fix some of them, and it records the specifics in the CBS log. That result usually means the local store of clean copies is damaged too, which is exactly the situation DISM RestoreHealth exists to fix. Run DISM, then run SFC once more before concluding anything is unrecoverable.

When should I stop repairing and reset Windows instead?

When the service registration is gone, when DISM cannot repair the component store even with a mounted install image, or when SFC reports the same unfixable files after a successful DISM run. At that point an in-place upgrade is the next step rather than a reset, because it replaces the system files while keeping your data and applications.

Worth Reading Next

Revision note. Originally published March 15, 2016 as a fifteen-step msconfig walkthrough. Rewritten August 22, 2026 for Windows 11 and Windows 10. What changed: the TrustedInstaller service is now named as the actual cause rather than worked around silently, the msconfig steps have been kept but placed as one route among several, the DISM error 87 explanation is new, and a link to a post we have since retired has been removed. If your machine lands somewhere this page does not cover, please write in and tell us what the commands said — pages like this stay accurate because readers do exactly that. And if you are here at the end of a long evening with a laptop that will not cooperate, it is very probably a switch someone flipped rather than anything you broke.