15

I have a Windows server that will sometimes reboot into safe mode after updates. I'm working on that issue but what I'd really like to know is how can I check to see if Windows is running in safe mode or not.

Ideally I would like to incorporate it into a script that would send a passive check to our Nagios box with the status.

Is there some environmental variable I can use or some way to get this information via the command line?

Massimo
  • 70,200
  • 57
  • 200
  • 323
cwd
  • 2,763
  • 9
  • 33
  • 48
  • 1
    There's no "single user mode" on Windows... are you talking about Safe Mode? – Massimo Oct 01 '12 at 19:05
  • 1
    updated question and changed "single user mode" to "safe mode" - my apologies – cwd Oct 01 '12 at 19:15
  • The question is actually interesting, I googled around a bit and couldn't find any reasonable way (as in, "without being a device driver") to programmatically check if a system is running in safe mode... I'm upvoting, but please unaccept @joeqwerty's answer, as he was talking about Terminal Services. – Massimo Oct 01 '12 at 19:18
  • 3
    You are doing this completely wrong. If you have a server that sometimes boots into safe mode you should be looking for the root cause, not a way to treat the symptom. The server will only do that after a severe crash. Find out what is causing the crashes and fix it. – John Gardeniers Oct 01 '12 at 20:42
  • 2
    @JohnGardeniers, to be honest, he *said* he's working on the issue... – Massimo Oct 01 '12 at 22:25

5 Answers5

25

I think this does what you are looking for

PS C:\> gwmi win32_computersystem | select BootupState

BootupState
-----------
Normal boot

http://msdn.microsoft.com/en-us/library/windows/desktop/aa394102%28v=vs.85%29.aspx

Possible return values:

Normal boot
Fail-safe boot
Fail-safe with network boot
Clayton
  • 4,523
  • 17
  • 24
9

According to this article, an environment variable called SAFEBOOT_OPTION is set to either Minimal or Network if the system is started in Safe Mode or in Safe Mode with Networking; otherwise, the variable is unset.

A test on the variable's value should do the trick; however, keep in mind that if the system is actually running in Safe Mode, it'll have no networking to begin with, so reporting its status could be... difficult.

mirh
  • 167
  • 7
Massimo
  • 70,200
  • 57
  • 200
  • 323
6

You can also run the WMI query suggested by Craig620 directly from the command line, if you're not using PowerShell:

> wmic COMPUTERSYSTEM GET BootupState

BootupState
Normal boot
Community
  • 1
Massimo
  • 70,200
  • 57
  • 200
  • 323
3

EDIT: my bad, I didn't read the KB thoroughly enough to realize it's basically useless as an answer on its own.

A more useful way to determine if you're in safe mode of not is from: Microsoft® Windows® Internals: Microsoft Windows ServerTM 2003, Windows XP, and Windows 2000 by Mark E. Russinovich, David A. Solomon.

The Windows kernel scans boot parameters in search of the safe-mode switches early during the boot and sets the internal variable InitSafeBootMode to a value that reflects the switches the kernel finds. The kernel writes the InitSafeBootMode value to the registry value HKLM\SYSTEM\CurrentControlSet\SafeBoot\Option\Option Value so that user-mode components, such as the SCM, can determine what boot mode the system is in.

Take the above and pair with the below, and you'll a have registry location you can check with a numerical value you can translate into something useful.

From the support.microsoft KB titled, "How to determine whether the system is running in Safe Mode from a device driver."

The Windows OS kernel exports a pointer to a ULONG variable that is named InitSafeBootMode. This variable contains the Safe Mode settings.

A device driver can determine whether the system is running in Safe Mode by the value of the InitSafeBootMode variable. A value of 0 means that the system is not running in Safe Mode.

The following table lists the modes for other values.
Value Mode
1 SAFEBOOT_MINIMAL
2 SAFEBOOT_NETWORK
3* SAFEBOOT_DSREPAIR
*Note The value of 3 applies to Windows domain controllers only.

mirh
  • 167
  • 7
HopelessN00b
  • 53,795
  • 33
  • 135
  • 209
  • Any way to check this via the command line or would I need to write an application that could check `InitSafeBootMode` ? – cwd Oct 01 '12 at 19:27
  • That's what I was referring to with my comment "I couldn't find any reasonable way"... even if you could write a device driver to check that, getting it to run on the target system would be *quite* tricky. – Massimo Oct 01 '12 at 19:28
  • @cwd You would actually need a kernel-mode driver. And to have it installed. And running even in safe mode. And then an application to talk with the driver and report its status. This would get really ugly really quick. – Massimo Oct 01 '12 at 19:29
  • 1
    @cwd there you go, didn't check closely enough when I found the link to the KB. Answer should contain useful information for you now. – HopelessN00b Oct 01 '12 at 19:45
  • @HopelessN00b Confirmed (I actually rebooted in Safe Mode to check). The key `HKLM\SYSTEM\CurrentControlSet\SafeBoot\Option` doesn't exist at all on a non-Safe-Mode system, but it does on a Safe Mode one. – Massimo Oct 01 '12 at 19:57
1

HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions contains a string and if you are in safe mode there will be a "SAFEBOOT:???" within the string where ??? is MINIMAL or NETWORK. This gets updated on each boot.

ADY
  • 93
  • 1
  • 12