Safe Mode in Windows

By . Last modified: 2014-08-14.

How to use Safe Mode for running security scans or diagnostics, or managing software and device drivers in Windows XP, Vista, 7, 8 and 8.1

Here are some troubleshooting steps to try before using Safe Mode:

  • Last Known Good Configuration often solves booting and stability problems after installing software, drivers, or messing with Registry entries. This is available for Windows XP, Vista and 7 only.
  • If Windows is able to boot, use System File Checker and icacls.exe to repair corrupted system files.
  • While Windows is running, use free WhoCrashed for determining BSOD (Blue Screen Of Death) causes.
    In Windows Vista and later, Reliability Monitor might also reveal faulty drivers or software.

In Safe Mode you can adjust all settings you might have changed before failure, remove or add drivers, uninstall or install some software (the ones that do not depend on Windows Installer), and remove hard-to-delete viruses and malware.
You can also use System Restore in Safe Mode.

If you need to forward errors or screenshots to IT support, get accustomed to the Take screenshots for troubleshooting in Windows and Use Problem Steps Recorder for troubleshooting in Windows 7 and 8 articles.

Safe Mode is still a limited mode where several functions do not work at all. This is because only essential services are loaded to prevent malware and problematic programs/drivers from loading.

A big advantage of Safe Mode is that is checks and repairs all essential system files and, if necessary, runs a disk check. This way, all trivial problems are solved just by starting Windows in that mode.

Getting into Safe Mode in Windows XP, Vista and 7

In Windows XP, Vista and 7, press F8 key on your keyboard during boot while the big logo or black screen with white texts is displayed.
On some computers you will see a boot selection after pressing F8, cancel that by pressing Esc key on your keyboard and then press F8 key again.

First you might see an operating system selection screen. Select the correct one with arrow keys and press Enter key. If you already pressed F8 repeatedly, this screen might not appear.

There are three different types of Safe Mode available, usually the first one works best. If you want to troubleshoot a device or its drivers, work with settings and registry, always choose the first one - pure Safe Mode!
If you need access to the Internet while using Safe Mode (for example, for installing or updating anti-virus and anti-malware programs), select Safe Mode with Networking instead.
Safe Mode with Command Prompt is not really of much use unless you know all different command-line programs by heart. We will not cover this mode here, as it is meant for advanced users only.
Choose your liking with arrow keys on your keyboard and press Enter to start it.
Windows XP, Advanced Options Menu. Select Safe Mode and press Enter key. If you need networking or Internet access, select Safe Mode with Networking instead. Windows 7, Advanced Boot Options menu. Select Safe Mode and press Enter key. If you need networking or Internet access, select Safe Mode with Networking instead.

Getting into Safe Mode in Windows 8 and 8.1

In Windows 8/8.1, the good old F8 key trick does not work anymore (you can, however, turn the F8 key functionality back on for your convenience). If Windows 8 or 8.1 detects that it is unable to start, you can get into new Startup Settings: click See advanced repair options in Recovery screen, or click Advanced options after Automatic Repair fails.
Windows 8, Recovery, It looks like Windows didn't load correctly. Click 'See advanced repair options' to access troubleshooting tools. Windows 8, Automatic Repair couldn't repair your PC. Click 'Advanced options' to access troubleshooting tools.

If Windows 8 or 8.1 is able to start and run and you can use at least one monitor, open Settings charm using keyboard shortcut Windows Key+I. The fastest way is to click Power and then hold down Shift key while clicking Restart. This will reboot into Windows 8/8.1 Advanced Startup screen.

The longer way is to click Change PC settings in the bottom.
Windows 8, Settings bar. Click 'Change PC settings' to access troubleshooting tools.

In Windows 8, click to open General tab of PC settings app, scroll all the way down to Advanced startup section and click Restart now.
Windows 8, PC Settings, General tab. Click 'Restart now' in Advanced startup section to access troubleshooting tools.

In Windows 8.1, open Update & Recovery tab on the bottom left and then click Recovery tab. Click Restart now in the Advanced startup section.
WWindows 8.1, PC Settings, Update & recovery, Recovery tab. Click 'Restart now' in Advanced startup section to access troubleshooting tools.

This is how Windows 8/8.1 Advanced startup screen looks like.
Click Troubleshooting in Choose an option screen. Next, in Troubleshoot screen, click Advanced options tile. Then, in Advanced options screen, click Startup Settings. And finally, in Startup Settings screen, click Restart.
Windows 8, Advanced startup, Choose an option. Click Troubleshoot. Windows 8, Advanced startup, Troubleshoot. Click Advanced options. Windows 8, Advanced startup, Advanced options. Click Startup Settings. Windows 8, Advanced startup, Startup Settings. Click Restart.

Windows 8/8.1 then reveal their brand new Startup Settings screen.
Press number 4 key or F4 key to Enable Safe Mode - this one is the best bet if you do not need Internet access.
Press number 5 key or F5 key to Enable Safe Mode with Networking - use this one in case you need Internet access for downloading applications or updating anti-virus or anti-malware products.
Windows 8, Advanced startup, Startup Settings, Press a number to choose from the options below. Press number 4 key or F4 key to enable Safe Mode.

Disk check runs before Safe Mode - do NOT interrupt!

Windows will load and check essential files and drivers. Next, it checks if a disk is marked "dirty" due to messed files and failed shutdown or startup.
If none of disks is flagged as containing errors, Windows starts in Safe Mode right away.

If a disk or partition needs checking, hard drive activity indicator light will flash or stay on for several minutes or even up to half an hour. Disk check most commonly starts after loading mup.sys, classpnp.sys or crcdisk.sys.

Do not turn off or restart your computer while the disk activity indicator light is on or flashes - you might cause severe damage to files on the disk!
If file system on your hard disk needs some thorough fixing, Windows might restart your computer once or twice before starting Safe Mode. In such cases, use F8 key again to choose Safe Mode, do not let Windows start normally.

In case your computer restarts more than three times without going to Safe Mode or it stops responding for more than 30 minutes during disk check, then Windows files are badly damaged and you will have to use other ways of repairing it (see next tutorials).
Windows XP, Safe Mode loads drivers and then checks for hard disk corruption. Please wait and do not turn off or reboot your computer! Windows 7, Safe Mode loads drivers and then checks for hard disk corruption. Please wait and do not turn off or reboot your computer!

In Windows XP, you might see a black screen with "Safe Mode" written to every corner for a while. This is normal.

You will then see your familiar logon screen. Click your user name, type your password and log on as usual. Both Start menu and My Computer will have Classic look, because Windows themes are disabled in Safe Mode. Desktop background will be black with white "Safe Mode" written to all four corners of screen.
In Windows XP, a dialog asking to choose between Safe Mode and System Restore appears. Click Yes here to continue working in Safe Mode.
In Windows Vista, 7, 8 and 8.1, Windows Help and Support will open a help page on Safe Mode. Close the window.
Windows XP, Safe Mode, Desktop prompt about Safe Mode and System Restore. Click Yes to continue working in Safe Mode. Windows Vista, Safe Mode. Windows has Classic look with black Desktop background and 'Safe Mode' written to all corners. Close Windows Help and Support window.

If you're lucky, restarting your computer and letting Windows start normally now might resolve your problems. If not, return to Safe Mode and explore other options.

Anti-virus and anti-malware scanning in Safe Mode

If you suspect a virus or some other malware is preventing Windows from starting or running correctly, run a full virus scan now - both avast! Free Antivirus and Microsoft Security Essentials (and Windows Defender in Windows 8/8.1) work if you have one of these programs installed (do not install more than one anti-virus program!).
Malwarebytes Anti-Malware on-demand scanner and ComboFix also work to help with removing stubborn malware.

If using Safe Mode with Networking, you can also download and install avast! Free Antivirus, Malwarebytes Anti-Malware or ComboFix. Perform a database update and then run a scan (see links above).

Checking for error events and using WhoCrashed in Safe Mode

While in Safe Mode, always check for error and warning events in Event Viewer, this might help a lot.
Ue keyboard shortcut Windows Key+R to open Run dialog, type eventvwr.msc and click OK.

Ignore typical Safe Mode events such as DCOM "This service cannot be started in Safe Mode" (Event ID 10005) and events with ID 7001. These events happen because Safe Mode starts only essential services to help fighting malware or stop problematic drivers/programs from loading. Scroll down in events list to find the time when your computer was still working and see if there were any error or warning events at that time.

Pay special attention to events with ID 7 and 55 in System log of Event Viewer - several recent entries might indicate a failing hard drive. You should run a full disk check in such case.

In Windows Vista, 7, 8 and 8.1, you can also check events in Applications and Services Logs, Microsoft, Windows, Diagnostics-Performance for finding out which programs and drivers may cause trouble. Read the Troubleshoot performance in Windows Vista and later tutorial for more details.

More important event log entries are listed in this Event Viewer tutorial.

You can also install and run free WhoCrashed for determining BSOD (Blue Screen Of Death) causes while Windows is running in Safe Mode. For downloading this great tool, you'll need Safe Mode with Networking.

While you're at it, you should also run a very limited disk clean-up. Open Windows/File Explorer using keyboard shortcut Windows Key+E, open Computer/This PC, right-click system drive (the drive where Windows is installed, most probably with drive letter C:) and click Properties.
Then click Disk Cleanup button. After a few moments a list appears - select only Temporary files there (deselect everything else!) and click OK. Cleaning other files can remove important data required for further troubleshooting and recovery, so once again: delete only Temporary files!
This will remove leftover files that can cause trouble sometimes.

Uninstalling and installing software in Safe Mode

If Windows problems appeared right after installing or updating a program, try uninstalling the ill-behaving software.
Please note that not all software can be uninstalled in Safe Mode! Programs that use Windows Installer for installing and uninstalling will give you a failure message. A rule of thumb is that if an installer file has .msi extension, it cannot be installed or uninstalled in Safe Mode.
You also cannot install Microsoft-provided security updates in this mode, even when installer has .exe extension - it just unpacks .msi or .msp package, tries to run it and fails.

To uninstall a program, click Start button or press Ctrl+Esc on your keyboard.
In Windows XP, click Control Panel and then open Add or Remove Programs.
In Windows Vista and 7, type "program" into Start menu Search Box and click Programs and Features.
In Windows 8 and 8.1, open Settings search using keyboard shortcut Windows Key+W, type "uninstall" into Search box and click Uninstall a program.
Windows XP, Start menu in Safe Mode. To uninstall a program, click Control Panel. Then open Add or remove programs. Windows Vista, Start menu in Safe Mode. To uninstall a program, type 'program' into Start menu Search Box. Click Programs and Features. Windows 8, Start screen, Settings Search. To remove an application, type 'uninstall' into Search box. Then click Uninstall a program.

The installed software list might take a while to build. After the list appears, find the program you want to uninstall.
In Windows XP, click the program and then click the Remove or Change/Remove button.
In Windows Vista, 7, 8 and 8.1, right-click the program name and select Uninstall or Uninstall/Change.
Windows XP, Safe Mode, Add or Remove Programs list. Click the program you want to uninstall and then click Remove or Change/Remove. Windows 7 Safe Mode, Add or Remove programs list. Right-click the program you want to remove and then click Uninstall or Uninstall/Change.

Windows will probably ask if you want to remove the program. Click Yes.
If the program can be removed, its uninstaller will start. Follow its instructions and select "Uninstall" or "Remove" when needed.

You might see an error message "The Windows Installer Service could not be accessed". This means that this program cannot be removed in Safe Mode.
Windows 7, Safe Mode. Program removal failed because Windows Installer Service could not be accessed. Removing this program in Safe Mode is not possible.

Rolling back, disabling or uninstalling drivers in Safe Mode

If the problems appeared after installing or updating a driver, remove the troublesome one using Device Manager.
In all versions of Windows, use keyboard shortcut Windows Key+R to open Run dialog. Type devmgmt.msc and click OK.
Windows XP, Safe Mode. To uninstall or roll back a driver, open Start menu and click Run. Type 'devmgmt.msc' and click OK.

Rolling back a driver in Device Manager

Use Roll Back Driver if the device was present before and worked fine until a driver update. You can roll back drivers only if the device had some other drivers installed before.

Find the device that caused trouble, right-click on its name and click Properties:
Windows 7, Safe Mode, Device Manager. Right-click on the device with driver problem and select Properties.

Now click on Driver tab above and then click on Roll Back Driver.
In Windows 8 and 8.1, you can also open Events tab and see driver installation history to be really sure the device driver was recently updated.
Windows 7, Safe Mode, Device Properties. Click Roll Back Driver to revert to previous driver that worked fine. Windows 8, Safe Mode, Device Properties, Events tab. This lists driver installation history.

Answer Yes in Driver Package rollback dialog.
Windows 7, Safe Mode, Driver Package rollback. Click Yes to revert to previously installed driver version.

Disabling a device/driver in Device Manager

Disable a device if you want to verify that the device is causing problems with Windows starting or working properly. This is useful in case the hardware used to work fine and its driver has not been recently updated, but it seems to be causing trouble now.
Disabling is good for temporary testing and you do not have to reinstall its drivers if this device appears to be working well after all.

Find and right-click the device in question. Click Disable.
Windows 7, Safe Mode, Device Manager. Right-click on the possibly problematic device and select Disable.

Answer Yes.
Windows 7, Safe Mode, disabling a device. Click Yes to stop using a device.

Uninstalling a device in Device Manager

Use Uninstall if you want to remove a device physically afterwards. Just removing the device from your computer might not give expected results because buggy drivers might still get loaded and cause trouble.

Find the device you want to remove and right-click it. Select Uninstall.
Windows 7, Safe Mode, Device Manager. Right-click on the device you want to physically remove from your computer and select Uninstall.

Click Yes.
Windows 7, Safe Mode, Confirm Device Uninstall. Click Yes.

After using Device Manager for rolling back a driver or disabling a device, restart your computer and see if Windows now works better.
If you uninstalled a driver, shut down your computer, unplug power cord and remove the hardware device. Then start Windows and check if everything works fine.


Sub Navigation

Sub Navigation
Next: System Restore in Windows
Previous: Low-resolution video (VGA Mode) in Windows
comments powered by Disqus