This article describes how to determine whether the system is running in Safe Mode from a device driver.
The Windows OS kernel exports a pointer to a ULONG variable that is named
InitSafeBootMode. This variable contains the Safe Mode settings.
A device driver can determine whether the system is running in Safe Mode by the value of the
InitSafeBootMode variable.
A value of
0 means that the system is
not running in Safe Mode.
The following table lists the modes for other values.
Collapse this tableExpand this table
| Value | Mode |
| 1 | SAFEBOOT_MINIMAL |
| 2 | SAFEBOOT_NETWORK |
| 3* | SAFEBOOT_DSREPAIR |
The value of 3 applies to Windows domain controllers only.
You must declare the following in your driver.
extern PULONG InitSafeBootMode;
You must check the value of
InitSafeBootMode to determine whether the system is running in Safe Mode.
if (*InitSafeBootMode > 0){
// The system is in Safe Mode.
// Take appropriate action.
//
} For example, to prevent a driver from working in Safe Mode, use one of the following methods:
- Function drivers
If your function driver has a service start type of SERVICE_BOOT_START, check the value of the InitSafeBootMode variable in the AddDevice routine and return failure.
Note You must never return failure from the DriverEntry routine. - Filter drivers
If your filter driver starts during boot time, check the value of the InitSafeBootMode variable in the AddDevice routine. Do not attach to the device stack. Return success from the AddDevice routine. - Other drivers
For drivers that are not mentioned earlier, check the value of the InitSafeBootMode variable in the DriverEntry routine. Return failure if the system is in Safe Mode.