Last year I had to research on how to disable Windows Safe Mode because my boss son very often mess around with his home desktop computer so badly that I had to fix it for him all the time. Disabling Windows Safe Mode is not the perfect way of prevent the computer from being messed around but it goes give some extra security.
The last time I found out that we can disable access to safe mode by changing the Minimal and Network keys in registry to cause the computer to blue screen whenever you try to boot in to Safe Mode. It’s a fairly simple trick that works, maybe a little too simple that when the attacker knows about this trick, he/she can reverse the changes by editing the registry. This trick no longer works for my boss son because somehow he knew how to get around it. Maybe he found this site and learned which registry key to modify?
No worries, I found two more methods on how to disable the F8 key before booting up Windows.
The first and widely known method is to hexedit the hidden NTLDR file in the root of the drive where the operating system is installed. Please take note that this method only works on XP and not Vista since Vista no longer has NTLDR. Just follow the steps below on how to do it.
1. Assuming that you installed Windows in C: drive, type this in run attrib -r -s -h -a c:\ntldr
If you installed Windows in D: drive, then change o d:\ntldr
2. Backup ntldr file in C: drive to another name. You can do that by copying and pasting to the same location to get a new file “Copy of ntldr”
3. Download a free portable hex editor, extract and run Hedit.exe
4. Go to File > Open, select C:\ drive on the right hand side and look for ntldr file on the left box. Select the ntldr file and click OK.
5. Scroll down a little and look for the line 00000770 and change the values 0f 85 09 to 90 90 90.
6. Click File > Save and close Hedit.
7. Type this command in run attrib +r +s +h +a c:\ntldr
You can now restart your computer and both F8 and F5 key no longer works before starting up Windows! This hack totally disable keyboard input so that when you hit F8 or F5 before starting up Windows, there is no effect at all. If you have multiple operating system installed, this method would not be the best choice because you can’t move up or down to select which operating system to boot in to. When you want to boot in to Safe Mode when Windows is unable to start, you can boot up the computer with UBCD, linux live cd or even windows installation disc for recovery console and rename the “Copy of ntldr” file to ntldr. This way you can use the F8 key again.
If you want to disable the F8 key for Vista, I found a shareware called NoSafeMode. It can disable F8, Safe Mode and Advanced Boot Options in Windows 2000, XP, Vista and even the upcoming Windows 7!
NoSafeMode claims to do all that without hack or modification of operating system files and registry. Finally, NoSafeMode even has a password option to allow only authorized users to access ALL boot options by using the lock password (You’ll need to press Ctrl + F8 key to enter the password at when you normally press F8 to access the Advanced Boot Menu).
I’ve tried to use SysTracer and Total Uninstall to find any changes being made by NoSafeMode but couldn’t find anything. Until now I still couldn’t figure out how does NoSafeMode works but I am sure it doesn’t modify/create/delete any files or registry.
NoSafeMode personal edition cost €19.95 where you are allowed to use this tool on any machine you own personally. If you want to use it in your work place, you’ll have to pay €99.95 for the professional edition to use this tool on any machine owned by the same company. It’s quite costly, and I think that’s because maybe this is the only tool that can disable F8 key on Vista without modifying any files/registry.
Related posts:
How to use NTLDR to disable other F keys?
Disable Safe Mode – Microsoft Windows command line tool
disablesafemode.com/
The perfect solution for Vista or later …
There is no registry or MBR modifications so I can use my dual boot system.
can you tell me how you cracked it?
thnx
kind regards
Edwin
I have crack it!
eu tenho uma lan com o gerenciador de lanhouse handycafe instalado e algumas pessoas tentavam acessar usando a tecla f8 mas com a dica do hexedit eu consegui resolver o problema vlw….
thanks raymond this time its work ure post problem about safemode i reli appriciate it
Thanks !!
thnx thnx raymond…thats pretty cool . it workss now i cud
away loser from my computer lolzz
Good article. At a guess, NoSafeMode modifies the MBR to capture keyboard input until the os is loaded. This would prevent any bootloader like linux or windows any flavour.
Restoring the MBR via windows recovery cd would reverse NoSafeMode changes.
Parabéns pela dica meu camarada… …
HellNoire, GRUB/LILO/etc. load before Windows. Disabling the keyboard keys in the Windows loader will have no effect on it.
–Another *nix guru.
@Deyaa Addeen Fahmy Shedeed & Mithun John Jacob:
What about reading the article?
“The last time I found out that we can disable access to safe mode by changing the Minimal and Network keys in registry”
Since you’re editing the bytes code…
instead of disabling it completely… why not map it to another key instead of F8… i don’t think anyone will be free enough to try all the keys to find out which one is it.
this is good
Enlightening product Ray. A must have for the security conscious people.
I’m aware Raymond. I read the whole thing, yet misread the end. I’ll check it out, see if it’s any good. I need something to keep my dad out of my computer.
Fail
from the author’s website:
‘Disables ALL keys during boot process, so the system boots without any interference.’
can confirm does not work on my laptop duel booting windows vista (x64) and windows 7 (x86), it disregards all keyboard options even the CTRL+F8 during the bootup process.
Would advise against using this tool
I really hope you guys will read the whole article because most of the time the answer to your question is already answered.
Mithun John Jacob, already posted last year.
raymond.cc/blog/archives/2008/08/15/disable-windows-safe-mode-for-extra-security-to-prevent-tampering/
HellNoire, I did mention NoSafeMode.
Thank you Raymond nice trick ;-)
Raymond, as your “Linux Guru”, I think I should ask this:
“If you have multiple operating system installed, this method would not be the best choice because you can’t move up or down to select which operating system to boot in to.”
That would make me rather angry and a few of my friends annoyed, due to the dual boot nature of our computers. So is there any way we can disable Safe Mode without having to prevent GRUB from working?
wow !!
thanx RAY.
Raymond what about this…
Hope this is easier :
1. Go to Start > Run
2. Type regedit and click OK
3. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot
4. Expand SafeBoot by clicking the + sign and you should see 2 keys with the name Minimal and Network.
5. Rename both of the keys to something else, example, Minimal to MinimalX and Network to NetworkX.
Another great tip thanks mate!
After i purchased my Saitek Eclispse keyboard i noticed the keyboard does not work until after the computer boots, i have to plugin my default keyboard my computer came with if i want to F8. I saw this as a extra security measure so made no attempt to fix it or find out how to fix it.
Thx Ray…
nice find.. thnx a lot :)
There is a method via regedit, but I can’t explain it .
If possible do it.
thanks any way .
excellent tip!!!!!
thnx Raymond
Its really exist nosafemode, thanks for the link, its good for secure environment that provide the setting for human activity, especially for pc that contains sensitive infos.
w00t good find. I think ill need this just incase i mess up and stuff or accidents happen