Select the product you need help with

How to determine whether the system is running in Safe Mode from a device driver

Article ID: 837643 - View products that this article applies to.

SUMMARY

This article describes how to determine whether the system is running in Safe Mode from a device driver.

The Windows OS kernel exports a pointer to a ULONG variable that is named InitSafeBootMode. This variable contains the Safe Mode settings.

A device driver can determine whether the system is running in Safe Mode by the value of the InitSafeBootMode variable. A value of 0 means that the system is not running in Safe Mode.

The following table lists the modes for other values.

Collapse this tableExpand this table

Value	Mode
1	SAFEBOOT_MINIMAL
2	SAFEBOOT_NETWORK
3*	SAFEBOOT_DSREPAIR

*Note The value of 3 applies to Windows domain controllers only.

You must declare the following in your driver.

extern PULONG InitSafeBootMode;

You must check the value of InitSafeBootMode to determine whether the system is running in Safe Mode.

if (*InitSafeBootMode > 0){ 

     // The system is in Safe Mode. 
     // Take appropriate action. 
     //     
}

For example, to prevent a driver from working in Safe Mode, use one of the following methods:

Function drivers

If your function driver has a service start type of SERVICE_BOOT_START, check the value of the InitSafeBootMode variable in the AddDevice routine and return failure.

Note You must never return failure from the DriverEntry routine.
Filter drivers

If your filter driver starts during boot time, check the value of the InitSafeBootMode variable in the AddDevice routine. Do not attach to the device stack. Return success from the AddDevice routine.
Other drivers

For drivers that are not mentioned earlier, check the value of the InitSafeBootMode variable in the DriverEntry routine. Return failure if the system is in Safe Mode.