[help] Disable Windows Xp Safe Mode

[roy1984]

Hi there...

I need a disable windows xp safe by clicking F8 during booting, for security issue

is there anyone can help me on this?

thanks

[TheFlash428]

...not sure this is possible...?

What would be better would be to explain why you want to disable SAFE MODE and/or what you are trying to prevent others from doing on a the computer in question, as there may be an alternate (if not better) method of achieving that goal.

[cluberti]

Since the menu and startup options are part of the loader process binary, you'll find this very difficult to do.

[roy1984]

Is there any solution to modify the list?... i just want to remove the safe mode list from the Windows Advanced Options Menu...to prevent others user access it

-------------------------------------------------------------------------------------------

Windows Advanced Options Menu

Please select an option:

Safe Mode

Safe Mode with Networking

Safe Mode with Command Prompt

Enable Boot Logging

Enable VGA mode

Last Known Good Configuration (your most recent settings that worked)

Directory Services Restore Mode (Windows domain controllers only)

Debugging Mode

Start Windows Normally

Reboot

Return to OS Choices Menu

--------------------------------------------------------------------------------------------

[TheFlash428]

As stated before, there is no easy (if any) way to do this, plus I'm not sure you would want to remove SAFE MODE capability.

What is it exactly you are trying to prevent users from doing by booting into safe mode?

[roy1984]

The users are using the "Directory Services Restore Mode (Windows domain controllers only)" to by pass the system control software that installed in the windows xp . They access and use the pc without my permission

That's why i need to know the way to Disable those menu or whatever

Only Windows normal mode that i want

by the way.... TheFlash428, you are not helping here... stop cheating post

[cluberti]

by the way.... TheFlash428, you are not helping here... stop cheating post

I think I've already mentioned that this is built into the NT binaries used to load the machine. Modifying this menu means modifying the source and recompiling these binaries. Since that would be highly illegal, you are SOL. There is no workaround - if your users are using safe mode to use the machines, perhaps an administrative approach would be best suited to resolve this issue, rather than a technical approach.

[gosh]

there's always a way around something as long as you have an imagination. The way apps know you are in safe mode is the registry key HKLM\system\current control set\control\safeboot\option. This keys is only created when you enter safe mode, once you exit safe mode the key is deleted.

A good example of this is sharing. if you look at HKCR\Drive, under shellex you'll see Sharing, with class id {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}. If you look at HKCR\Clsid\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}, you'll see xp uses ntshrui.dll for sharing. If you look at this file in notepad or a hex editor you'll see this:

O p t i o n V a l u e S Y S T E M \ C u r r e n t C o n t r o l S e t \ C o n t r o l \ S a f e B o o t \ O p t i o n

here's what happens. When you go to the sharing tab on a drive, ntshrui.dll checks that registry key, which only exists in safe mode. If it sees this key, it assumes you're in safe mode and doesn't load. This is why on xp home edition in safe mode you have a Security tab.

So knowing this you could possibly disable safe mode by denying permissions on the safeboot key, causing the option key to not be created. You would have to do some research, but it's possible to disable safe mode this way.

The menu you see at startup is from ntldr i believe, or ntoskrnl.exe. You could simply hex edit these files to remote the option.

-gosh

Edited July 25, 2007 by gosh

[the_nets_edge]

Not sure running a PC in Safe Mode is really running the pc...but...

Are you using Active Directory? Can't you lock down the pc with 1 user name (+administrator) with tight passwords, and permit *ONLY* AD logons?

(you can also disassemble the keyboard and remove the contacts on the F8 key...)

The Nets Edge

[GrofLuigi]

(you can also disassemble the keyboard and remove the contacts on the F8 key...)

The Nets Edge

I like this solution.

But make sure you disable F5 also and glue the keyboard in so they couldn't bring in their own.

And there are programs to 'force' safe mode on next boot... You'd need to take care of that too.

GL

[shaan]

(you can also disassemble the keyboard and remove the contacts on the F8 key...)

The Nets Edge

I like this solution.

But make sure you disable F5 also and glue the keyboard in so they couldn't bring in their own.

And there are programs to 'force' safe mode on next boot... You'd need to take care of that too.

GL

LOOOOOOOOOL Just cant stop laughing.

Well u can disable safe mode (i did it) by deleting some registry values. i didnt remeber those exactly but i will let u know soon. and yes u can also search on google. i think u can find it.

[TheFlash428]

by the way.... TheFlash428, you are not helping here... stop cheating post

Wasn't trying to "cheat post" (whatever that means)--I was simply offering to try to help resolve your issue in a different manner since I did not believe that what you are trying to is possible.

[cluberti]

OK - I went ahead and played around to see if there was a good workaround, and found the following. Since safe mode loads up specific control sets in the registry, renaming these keys should "break" the loading of the relevant data to support safe mode. Note this doesn't actually disable the ability to press F8 and choose safe mode or safe mode w/ networking, but causes a bugcheck if someone tries to use it (so, I guess it's achieving the same ends):

Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot

Under the safe boot key, you should see two keys called "Minimal" and "Network". If you rename these keys (say, to "Minimal-disabled" and "Network-disabled", Windows will now not be able to load these hives when entering safe mode or safe mode w/ networking, and will bugcheck.

Note that an admin with registry access can revert this by renaming the keys in regular mode, and disabling safe mode could conceivably come back to bite you, but this should achieve what you want to do. Note that it does not remove the safe mode options (again, these are presented by the boot loader before the registry hives are even loaded), but will keep people from being able to use them until the reg changes are reverted.