disable safe mode

[spizotfl]

hi, i was wondering if there was a way to disable safe mode or password protect access to it? we have some systems at a school that we would like to monitor with some monitoring software. unfortunately we have discovered that if the system is started in safe mode, it completely bypasses the monitoring software. any thoughts??

 

[linney]

How do I disable Safe Mode? (NT, 2000, XP)
Windows NT, 2000 and XP do not have any easy way to disable Safe Mode. However, there is a way to 'break' safe mode temporarily.

Doing this is not recommended. Proceed at your own risk!

Click on the Start Button
Select Run
Type in "regedit" and hit OK
Expand the left hand side to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot
Under SafeBoot, you should now see Minimal and Network. Click on them and hit F2 to rename them to "Minimal-" and "Network-", respectively.
This should cause Windows to crash the next time it is booted into Safe Mode."

http://watchdogpc.com/help-guides-faq.shtml#10

http://www.google.com/search?source...2005-28,GGLG:en&q="disable+safe+mode"+windows

http://groups.google.com/groups?sou...2005-28,GGLG:en&q="disable+safe+mode"+windows

 

[spizotfl]

any way to password protect the options? or to limit access to specific users? it isn't that the kids are messing with system stuff, they are just using safe mode to bypass the monitoring app.

 

[linney]

Make sure you have an Administrator Password set and not just entry via a blank password. This will not prevent them using their own password however. Options within Safe Mode will be limited to any users just by the nature of Safe Mode itself.

Short of glueing the F8 key, I don't know what else you can do.

Why wont your monitoring software work in Safe Mode? Perhaps it would be easier to find some monitoring program that will work in Safe Mode?

 

[spizotfl]

it probably would be easier to have monitoring software that worked in safe mode, but we are a fairly small non-profit and have to work with what we're given.... it was worth a shot, though.

 

[Sympology]

Why wont your monitoring software work in Safe Mode? Perhaps it would be easier to find some monitoring program that will work in Safe Mode?"


Most programs don't work in safe mode, especially monitoring ones as they tend to require network access etc etc.

Stu..

Only the truly stupid believe they know everything.
Stu.. 2004

 

[Jasen]

The whole point of safe mode is that it won't load any third party applications. I can't even think how you would write software to force itself to load, except by trojaning itself onto a system file. And you wouldn't catch me installing that on my network.
How are they logging on? Local account or domain logins? If it's a domian login, set a login script that merely fires off your monitoring software, if possible. Then again, if it's a service, Windows may prevent that service from being started, so you're back in the same boat.
My personal preference would be to write a quick VB script that is fired off from the logon script. It would check the value of the "SAFEBOOT_OPTION" environment variable, and if present (meaning the system is in safemode), I would grab the currently logged in user (%username% environment variable) and email that to myself, and then immediately issue a "shutdown -t 2 -c "Safemode is not allowed here."" command.
That'll stop them from using safemode with network access, and it tells me whose accounts to go lock.

 

[spizotfl]

thanks jasen, i don't know too much about scripting and i am trying to save my boss from having to do everything... can you recommend any good references that would help me throw together such a script?
thanks

 

[Madawc]

Lateral thinking - remove the keyboards when the machines are not supposed to be used?

Madawc Williams (East Anglia, UK). Using Windows XP & Crystal 10

 

[Madawc]

Or course a dedicated hacker would bring their own keyboard. An alternative is NOT to shut down, but simply lock the machine with [window-key]L, and have a password. Wasteful of energy, but you can set the machine to hybernate.

Madawc Williams (East Anglia, UK). Using Windows XP & Crystal 10

 

[spizotfl]

removing the keyboards would be great, but we can't guarantee the people at the site would bother. they are currently supposed to collect the mouses, but that doesn't happen.

 

[Jasen]

Here's a quick, simple example. This doesn't do any emailing, but it does capture the username, which you could then use to do whatever you wanted.

Set WMIService = GetObject("winmgmts:\\.\root\cimv2")
Set Items = WMIService.ExecQuery("Select * from Win32_Environment")
safemode = false

For Each SubItems in Items
   if subitems.name = "SAFEBOOT_OPTION" then
      safemode = True
   end if
   
   if subitems.name = "lib" then
      username = subItems.Username
   end if
Next

if safemode = True then
   msgbox "We caught you " & username
   set objShell = CreateObject("WScript.Shell")
   objShell.run "shutdown -s -t 1", 1, False
end if

save it as a .vbs file to test it

 

[spizotfl]

should this script work in 2000? i copied it and jumped into safemode. when i ran it i got the error:
The system cannot find the file specified.
Line: 18
Char: 4
Code: 80070002
Sourcenull)
objShell.run "shutdown -s -t 1", 1, False
looks like line 18.

also, is there a way to test for safemode with networking? i think in the end, that is probably what i need to do without i just didn't think it through.

thanks for the help and suggestions

 

[Jasen]

ah, no shutdown command in Win2k? I thought it had it.

To check for network enabled safemode, you'd want to look at the value of safeboot_option. "Network" or "minimal". Minimal being normal safemode.

Ok, if there is no DOS shutdown command, we can do it with WMI script. The code would then look like this:

Set WMIService = GetObject("winmgmts:\\.\root\cimv2")
Set Items = WMIService.ExecQuery("Select * from Win32_Environment")
safemode = false

For Each SubItems in Items
   if SubItems.Name = "SAFEBOOT_OPTION" and SubItems.VariableValue = "Network" then
      safemode = True
   end if
   
   if subitems.name = "lib" then
      username = subItems.Username
   end if
Next
if safemode = True then
   msgbox "We caught you " & username
   Set OpSysSet = WMIService.ExecQuery("select * from Win32_OperatingSystem where Primary=true")
   For each OpSys in OpSysSet
      OpSys.Shutdown()
   next
end if

Probably the better way to do it anyway.

 

[spizotfl]

is this also a .vbs file? do i have to do anything special to make to prog go automagically? thanks for all the help...