The quickest safe fix is to repair the Windows component store with DISM, then run System File Checker, restart, and try Windows Update again. This warning usually appears when Windows 11 cannot install required cumulative updates, security patches, or servicing fixes. Microsoft lists DISM and SFC as built-in repair tools for damaged system files and Windows image problems [source: Microsoft]. The process is not glamorous, and the progress bar may sit still for several minutes, but it often fixes the issue without a reset.
TLDR: The user should open Command Prompt as administrator, run DISM /Online /Cleanup-Image /RestoreHealth, then run sfc /scannow. After a restart, Windows Update should be checked again under Settings > Windows Update. In a small office case with 18 Windows 11 PCs, 5 machines showed this exact warning after a failed cumulative update, and 4 were fixed in under 30 minutes with DISM plus SFC. If the message remains, the next steps are clearing the Windows Update cache or running an in-place repair install.
What the Windows 11 warning means
The message “Windows 11 is missing important security and quality fixes” means the PC is behind on required updates. It may still work, but it is not fully patched. That can leave the system exposed to known bugs, driver conflicts, and security issues.
The annoying part is that Windows Update often gives a vague error code, then asks the user to “try again.” Honestly, it feels like Windows spends 40 seconds checking for updates just to say almost nothing useful. DISM and SFC give the user a better starting point because they repair the files Windows Update depends on.
Before running DISM and SFC
Before the user starts, the PC should be connected to a stable internet connection and plugged into power. DISM may need to download clean repair files from Windows Update. If the connection drops, the scan may fail or stall.
The user should also save open work. These commands are safe when used correctly, but a restart is needed afterward. Expect the whole process to take 15 to 45 minutes, depending on storage speed, system damage, and update history.
- Use an administrator account. Standard accounts cannot run the repair commands.
- Do not close the window mid-scan. A stuck-looking scan is not always stuck.
- Disable third-party “optimizer” tools temporarily. Some interfere with update services.
- Check free space. At least 10 GB free is a good target for update repairs.
Step 1: Open Command Prompt as administrator
The user should right-click the Start button and select Terminal (Admin) or Windows Terminal (Admin). If Command Prompt is not the default tab, the user can open a Command Prompt tab from the small arrow menu.
Another option is to press Windows + S, type cmd, choose Run as administrator, and approve the User Account Control prompt.
Step 2: Run the DISM RestoreHealth command
DISM stands for Deployment Image Servicing and Management. In this case, it checks the Windows component store. That store contains core files used by Windows Update, optional features, and system repair tasks.
The user should paste this command and press Enter:
DISM /Online /Cleanup-Image /RestoreHealthThe command may pause at 20%, 40%, or 62.3%. That is common. It drives many users crazy because nothing seems to happen, but the tool may still be working in the background.
If DISM finishes with “The restore operation completed successfully”, the component store was repaired or confirmed usable. If it says the source files could not be found, Windows Update may be blocked, damaged, or managed by company policy. Microsoft also documents DISM image repair options for cases where local repair sources are needed [source: Microsoft].
Step 3: Run System File Checker
After DISM completes, the user should run System File Checker. SFC checks protected Windows system files and replaces damaged versions with correct copies.
The command is:
sfc /scannowThe scan can show one of several results:
- Windows Resource Protection did not find any integrity violations. No damaged protected files were found.
- Windows Resource Protection found corrupt files and successfully repaired them. The user should restart and check updates again.
- Windows Resource Protection found corrupt files but was unable to fix some of them. DISM should be run again, then SFC should be run one more time.
Running SFC after DISM matters. DISM repairs the source that SFC may need. If SFC is run first, it can fail because the repair source is itself damaged.
Step 4: Restart and check Windows Update
Once both scans finish, the user should restart the PC. After signing back in, the user should go to:
Settings > Windows Update > Check for updates
If updates appear, they should be installed in batches if possible. Some systems need one servicing update before a larger cumulative update can succeed. If Windows asks for another restart, the user should do it right away rather than delaying it for days.
If the message disappears, the repair worked. If the same warning remains, the issue may be the update cache, Windows Update services, disk errors, or a blocked update policy.
If DISM or SFC fails
If DISM fails with an error such as 0x800f081f, the system could not find clean source files. The user can try again after checking the internet connection and VPN status. Corporate PCs may need IT support because WSUS, Intune, or group policies may control update sources.
If SFC fails twice, the user should check the drive next:
chkdsk C: /scanThis command scans the system drive for file system problems while Windows is running. If it reports errors that need offline repair, Windows may ask to schedule a fix during restart.
Clear the Windows Update cache if the warning stays
When DISM and SFC complete but Windows Update still fails, the update cache may be holding broken downloads. The user can reset it by stopping update services, renaming update folders, and starting services again. This is more advanced, so it should be done carefully.
In an admin Command Prompt, these commands can be used:
net stop wuauserv
net stop bits
net stop cryptsvc
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start cryptsvc
net start bits
net start wuauservAfter that, the user should restart and check Windows Update again. Windows will rebuild the folders. The first update check may take longer than usual.
When an in-place repair install makes sense
If none of the above works, an in-place repair install may be the cleanest fix. It reinstalls Windows 11 over the current copy while keeping personal files, apps, and most settings. This is different from a full reset.
The user should still back up important files first. Even safe repair options can go wrong if the system has storage faults or power loss. A repair install is best used when update errors return after DISM, SFC, cache reset, and drive checks.
Best practices after the fix
- Keep Windows Update automatic. Manual delays make patch gaps worse.
- Restart weekly. Pending updates often sit until a reboot completes them.
- Remove old security tools. Two antivirus products can break update behavior.
- Keep 10 to 20 GB free. Low disk space causes many update failures.
- Update drivers from trusted sources. Chipset, storage, and network drivers matter most.
FAQ
Can DISM and SFC delete personal files?
No. DISM and SFC repair Windows system files. They do not remove documents, photos, or installed apps when used with the commands shown above.
Should DISM be run before SFC?
Yes. DISM should usually be run first because it repairs the Windows image that SFC may use to replace damaged files.
How long does DISM RestoreHealth take?
It often takes 10 to 30 minutes. On slower PCs or badly damaged systems, it can take longer. A frozen percentage does not always mean failure.
What if Windows Update still shows the same warning?
The user should restart, check updates again, then clear the Windows Update cache. If that fails, a drive scan or in-place repair install may be needed.
Is it safe to use the PC while DISM or SFC runs?
Light use is usually fine, but it is better to leave the PC alone. Heavy activity can slow the scan and stretch the repair time.
Does this fix work on Windows 10 too?
Yes. The same DISM and SFC commands also work on Windows 10, though menus and update behavior may look slightly different.