Home / server / Questions / 433765
Accepted
cwd
Asked: 2012-10-02 10:58:56 +0800 CST

How can I tell if Windows is running in Safe Mode?

  • 772

I have a Windows server that will sometimes reboot into safe mode after updates. I'm working on that issue but what I'd really like to know is how can I check to see if Windows is running in safe mode or not.

Ideally I would like to incorporate it into a script that would send a passive check to our Nagios box with the status.

Is there some environmental variable I can use or some way to get this information via the command line?

windows

5 Answers

  1. Best Answer

    I think this does what you are looking for

    PS C:\> gwmi win32_computersystem | select BootupState

BootupState
-----------
Normal boot

    http://msdn.microsoft.com/en-us/library/windows/desktop/aa394102%28v=vs.85%29.aspx

    Possible return values:

    Normal boot
Fail-safe boot
Fail-safe with network boot
    • 25

  2. According to this article, an environment variable called SAFEBOOT_OPTION is set to either Minimal or Network if the system is started in Safe Mode or in Safe Mode with Networking; otherwise, the variable is unset.

    A test on the variable's value should do the trick; however, keep in mind that if the system is actually running in Safe Mode, it'll have no networking to begin with, so reporting its status could be... difficult.

    • 9

  3. You can also run the WMI query suggested by Craig620 directly from the command line, if you're not using PowerShell:

    > wmic COMPUTERSYSTEM GET BootupState

BootupState
Normal boot
    • 6

  4. EDIT: my bad, I didn't read the KB thoroughly enough to realize it's basically useless as an answer on its own.

    A more useful way to determine if you're in safe mode of not is from: Microsoft® Windows® Internals: Microsoft Windows ServerTM 2003, Windows XP, and Windows 2000 by Mark E. Russinovich, David A. Solomon.

    The Windows kernel scans boot parameters in search of the safe-mode switches early during the boot and sets the internal variable InitSafeBootMode to a value that reflects the switches the kernel finds. The kernel writes the InitSafeBootMode value to the registry value HKLM\SYSTEM\CurrentControlSet\SafeBoot\Option\Option Value so that user-mode components, such as the SCM, can determine what boot mode the system is in.

    Take the above and pair with the below, and you'll a have registry location you can check with a numerical value you can translate into something useful.

    From the support.microsoft KB titled, "How to determine whether the system is running in Safe Mode from a device driver."

    The Windows OS kernel exports a pointer to a ULONG variable that is named InitSafeBootMode. This variable contains the Safe Mode settings.

    A device driver can determine whether the system is running in Safe Mode by the value of the InitSafeBootMode variable. A value of 0 means that the system is not running in Safe Mode.

    The following table lists the modes for other values.
    Value Mode
    1 SAFEBOOT_MINIMAL
    2 SAFEBOOT_NETWORK
    3* SAFEBOOT_DSREPAIR
    *Note The value of 3 applies to Windows domain controllers only.

    • 3

  5. HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions contains a string and if you are in safe mode there will be a "SAFEBOOT:???" within the string where ??? is MINIMAL or NETWORK. This gets updated on each boot.

    • 1