How can I tell if Windows is running in Safe Mode?
Solution 1:
I think this does what you are looking for
PS C:\> gwmi win32_computersystem | select BootupState
BootupState
-----------
Normal boot
http://msdn.microsoft.com/en-us/library/windows/desktop/aa394102%28v=vs.85%29.aspx
Possible return values:
Normal boot Fail-safe boot Fail-safe with network boot
Solution 2:
According to this article, an environment variable called SAFEBOOT_OPTION is set to either Minimal or Network if the system is started in Safe Mode or in Safe Mode with Networking; otherwise, the variable is unset.
A test on the variable's value should do the trick; however, keep in mind that if the system is actually running in Safe Mode, it'll have no networking to begin with, so reporting its status could be... difficult.
Solution 3:
You can also run the WMI query suggested by Craig620 directly from the command line, if you're not using PowerShell:
> wmic COMPUTERSYSTEM GET BootupState
BootupState
Normal boot
Solution 4:
EDIT: my bad, I didn't read the KB thoroughly enough to realize it's basically useless as an answer on its own.
A more useful way to determine if you're in safe mode of not is from: Microsoft® Windows® Internals: Microsoft Windows ServerTM 2003, Windows XP, and Windows 2000 by Mark E. Russinovich, David A. Solomon.
The Windows kernel scans boot parameters in search of the safe-mode switches early during the boot and sets the internal variable InitSafeBootMode to a value that reflects the switches the kernel finds. The kernel writes the InitSafeBootMode value to the registry value HKLM\SYSTEM\CurrentControlSet\SafeBoot\Option\Option Value so that user-mode components, such as the SCM, can determine what boot mode the system is in.
Take the above and pair with the below, and you'll a have registry location you can check with a numerical value you can translate into something useful.
From the support.microsoft KB titled, "How to determine whether the system is running in Safe Mode from a device driver."
The Windows OS kernel exports a pointer to a ULONG variable that is named InitSafeBootMode. This variable contains the Safe Mode settings.
A device driver can determine whether the system is running in Safe Mode by the value of the InitSafeBootMode variable. A value of 0 means that the system is not running in Safe Mode.
The following table lists the modes for other values.
Value Mode
1 SAFEBOOT_MINIMAL
2 SAFEBOOT_NETWORK
3* SAFEBOOT_DSREPAIR
*Note The value of 3 applies to Windows domain controllers only.