Using Safe Mode
When a driver decides to do bad things that cause a system to crash or behave erratically, you can try booting with a set of critical system drivers and nothing else. This is called Safe Mode. There are various flavors of Safe Mode. Access them by pressing F8 at the boot menu. Here is a list of the options in this menu:
This mode loads a bare set of peripheral drivers, 16-color VGA video, SCSI and IDE interfaces for mass storage, floppy interface, and a few system services. Safe Mode does not load network services. When you select this option, an environment variable called SAFEBOOT_OPTION=MINIMAL is set.
Safe Mode with Networking.
This option loads the same drivers as standard Safe Mode with the addition of network drivers. This mode is useful when you want to restore files across the network or run a third-party backup agent to do a tape restore. This mode sets the SAFEBOOT_OPTION=NETWORK environment variable.
Safe Mode with Command Prompt.
This is the same as Safe Mode except that the Explorer shell does not start. All you get is a bare command window. Use this mode if corruption in the Explorer files or abnormal Registry entries cause the machine to bugcheck in graphics mode. Avoid running graphical programs in the command window because they automatically launch Explorer, which could crash the machine. This mode sets SAFEBOOT_OPTION=MINIMAL in the environment.
Enable Boot Logging.
This is not a Safe Mode option. Use this option if you want a log of the kernel service drivers as they load. The output goes to a file called Ntbtlog.txt in the \Windows directory. The system boots with its normal contingent of drivers and services.
When booting to DS Restore Mode, Active Directory does not start. This means the Kerberos security provider is not available. The MSV1_0 security provider is the only source of authentication for local logon, and MSV1_0 uses the SAM to validate logon credentials.
When a server is promoted to domain controller, the old SAM is deleted and a new SAM put in place with a new Administrator account. The promotion wizard collects a password for this new Administrator account. When you boot to DS Repair Mode, you must log on using this password. I recommend writing it down and keeping the note in a secure place. One trick used by some administrators is to put the note inside the locked server.
Enable VGA Mode.
This is not a Safe Mode option. It replaces the currently loaded video drivers with standard 16-color VGA drivers. This is useful for troubleshooting video problems, although it can be a pain because you must manually reload the correct drivers after selecting this option. If you aren't sure of the correct drivers, you might find yourself searching around for the driver disk or downloading them again from the vendor's web site.
Last Known Good Configuration.
A troubleshooting option designed to return the System hive to a previously stable condition.
This option sets up the system for kernel-mode debugging. See the Microsoft Knowledgebase for a description of kernel-mode debugging.
Directory Service Restore Mode (Domain controllers only).
This is a special version of Safe Mode used to correct Active Directory database problems and to recover the System State files on a domain controller. This mode sets SAFEBOOT_OPTION=DSREPAIR in the environment.
You'll notice while you are in Safe Mode that the Desktop displays the Windows Server 2003 version number and build number along with the term free. This indicates that you're running a build that is free of debug symbols. A checked build consists of system files that contain the debug symbols used for kernel-mode debugging. A checked build runs more slowly and takes more memory.
While in Safe Mode, you can replace a problem driver or disable a service or install a different driver to correct a problem. You can run Jet repair utilities against any of the support databases. If you think your problem is more fundamental, you can use CHKNTFS to schedule a full disk scan at boot time.