4 Ways to Overcome Windows Resource Protection Could Not Start The Repair Service

 If the sfc /scannow command returns a “Windows resource protection could not start the repair service” error, it may be because there is a problem with the TrustedInstaller service. Here's how to fix it.

System File Checker tool, activated with the sfc /scannow command in the Command Prompt. This is a very useful system repair utility. Scans all protected system files and replaces corrupted files with cached copies located on the system. However, when running this command, you may encounter an error message that says "Windows resource protection could not start the repair service".

This error is often due to permissions issues or Windows TrustedInstaller not working. Having said that, let's explore how to solve Windows resource protection could not start the repair service.

Why SFC Scannow Not Working?

For System File Checker to work, Windows TrustedInstaller must be running. Windows TrustedInstaller is a service required to enable the installation, removal, and modification of Windows updates and other system components.

By default, TrustedInstaller controls the Windows Resource Protection (WRP) tool. WRP protects against unauthorized modification, including changes to important system files, folders, and registry keys. It also handles the “sfc /scannow” command you guys are trying to use.

That way, when TrustedInstaller crashes, other services that depend on it stop working too. This means that the WRP tool and System File Checker will fail to work properly. While there is no definitive solution for this problem, we have listed some troubleshooting steps that you can follow to fix this error.

How to Overcome Windows Resource Protection Could Not Start The Repair Service

1. Restart Windows TrustedInstaller (Windows Modules Installer)

If Windows TrustedInstaller isn't running or isn't working, quickly restarting the service can help clear up the error. You can easily restart it via the Windows Service Console. Here's how to do it.

Restart Windows TrustedInstaller

1. Press Win + R to open the Run box.

2. Then, type services.msc and click OK to open the Service Console.

3. In the Service Console window, find Windows Modules Installer.

4. Right click on the service and select Properties.

5. In the Properties window that appears, set the Startup type to Manual.

6. If the service is not running, click the Start button under the Service status section.

7. Click Apply and OK to save changes. Close the Service Console and check if you can run the System File Checker tool without throwing an error message.

2. Start TrustedInstaller Using Command Prompt

If restarting the Windows Modules Installer from the Service Console doesn't work, you can use the Command Prompt to restart it. Here's how to do it.

Start TrustedInstaller Using Command Prompt

1. Type cmd in the Windows search bar. From the search results, right-click on Command Prompt and click Run as Administrator. Click Yes when prompted by User Account Control.

2. In the Command Prompt window, type the command sc config trustedinstaller start= auto and press Enter to execute.

3. This command will set Windows Modules Installer service startup type to automatic. After successful execution, you will see the message ChangeServiceConfig SUCCESS displayed on the screen.

4. Next, enter the net start trustedinstaller command to restart the TrustedInstaller service.

5. After running successfully, run the command sfc /scannow and check if the error is resolved.

3. Run SFC Scannow In Safe Mode

In Safe Mode, Windows starts in a minimal state, loading a limited set of files and drives. Safe Mode is useful for finding conflicts from third-party applications or services that are causing problems on your system.

If you think a third-party application is causing a conflict with the System File Checker tool and triggering the Windows Resource Protection could not start the repair service error message, run the command sfc /scannow in Safe Boot mode to verify the problem. Here's how to run System File Checker in Safe Mode:

Run SFC Scannow In Safe Mode

1. Press Win + R to open the Run box.

2. Type msconfig.msc and click OK to open the System Configuration window.

3. In the window that appears, go to the Boot tab.

4. Under Boot options, tick the Safe boot option. Then, select the Minimal option.

5. Click Apply and OK to save changes.

6. Click the Restart button if you want to use Safe Mode immediately. If not, click Exit, save and close open applications, then restart your PC.

After the restart, your system will boot in Safe mode which only runs essential Windows services.

Now, open Command Prompt and run the command sfc /scannow . If the command runs without errors, a third-party application installed on your system is most likely in conflict with Windows Resource Protection, triggering the error.

To disable Safe Mode, launch System Configuration, go to the Boot tab and uncheck Safe boot under Boot options. Then, click Apply and Restart your PC.

4. Add the TrustedInstaller Expandable String Value to the Registry Editor

If you don't mind working with the Windows Registry editor, you can fix this error by adding an expandable string value to the Registry. However, if you make the wrong modifications to the registry entries, it could damage your system, so make sure to make a Windows registry backup before proceeding.

Additionally, create a system restore point. This will help you undo system-level changes and restore your PC to its working state. After having a backup, follow the steps below.

1. Find TrustedInstaller ID And Sub-folder Name In File Explorer

Find TrustedInstaller ID And Sub-folder Name In File Explorer

1. Press Win + E to open File Explorer and navigate to the location C:\Windows\Servicing\Version.

2. You will see a folder named something like 10.0.19041.1XXX. This is your TrustedInstaller ID. Copy the ID/name to the clipboard or paste it into a Notepad document.

3. Next, navigate to the location C:\Windows\WinSxS.

4. Here, depending on the CPU you are using, find one of these subfolders.

+ x86_microsoft-windows-servicingstack_31bf3856ad364e35_{TrustedInstaller ID} (32bit Windows)

+ amd64_microsoft-windows-servicingstack_31bf3856ad364e35_{TrustedInstaller ID} (64bit Windows)

5. In the subfolder name above, {TrustedInstaller ID} is the folder name you noted in step 2.

6. Copy the folder name and location to the Notepad file as well.

Find TrustedInstaller ID And Sub-folder Name In File Explorer

2 Create String Expandable Value In Registry Editor

Now that you have the necessary information, it's time to create an Expandable String value in the Registry Editor. Here's how to do it.

Create String Expandable Value In Registry Editor

1. Press Win + R to open Run.

2. Type regedit and click OK to open Registry Editor.

3. In the Registry Editor, navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Version location. You can copy and paste the path in the Registry Editor address bar for quick navigation:

4. Select and right click on the Versions subkey. Choose New > Expandable String Value.

5. Rename the value to match your TrustedInstaller ID name. After replacing it, it will look like this:

+10.0.19041.1XXX

6. Then double click on the newly created value and paste the folder location identified in WinSxS in the Value data field. It will look something like this:

+ %SystemRoot%\winsxs\amd64_microsoft-windows servicingstack_31bf3856ad364e35_10.0.19041.1XXX_none_7e3d47227c694b34

7. Make sure to use %SystemRoot% correctly and cut C:\Windows from the folder location.

8. Click OK to save changes.

Create String Expandable Value In Registry Editor

If you see an error message when generating subkeys or string values, you must have a Component Based Servicing key. You can take ownership of the key manually or use an automated tool to do it.

How to Retrieve Registry Key Ownership

How to Retrieve Registry Key Ownership

1. In the Registry Editor, right-click on Component Based Servicing and select Permissions.

2. In the Permissions window, click the Advanced button on the Security tab.

3. Owner, by default, is set to TrustedInstaller. Click Change links.

4. Type your username and click Check names. Click OK to save changes.

5. Check the box for Replace owner on sub containers and objects and click Apply for changes.

After changing ownership, you can modify the registry keys to add new values and subkeys without getting an error message.

Conclusion

So that's how to deal with Windows resource protection could not start the repair service. Any of these four fixes will allow you to fix Windows resource protection could not start the repair service and you will be able to run the sfc /scannow command normally again.

In most cases, you can fix this problem by tweaking the registry entries. However, if nothing else works, try a restore point or resetting your system to factory defaults.