Win Safe Mode

A professional, safe, and automation-friendly PowerShell utility for managing Windows 10/11 Safe Mode boot configuration through the current BCD entry {current}.

A focused Windows utility for safely rebuilding the Explorer icon and thumbnail cache.

---

Table of Contents

• Overview
• Features
• Requirements
• Installation
• Usage
• Parameters
• Logging & Diagnostics
• Safety & Security
• Exit Codes
• Architecture Workflow
• Screenshots
• Troubleshooting
• JSON Output
• Security Policy
• License
• Author

---

Overview v1.0.0

Win Safe Mode v1.0.0 provides an interactive menu and direct command-line modes for changing the Safe Mode configuration of the {current} Windows BCD entry with safety and reliability at its core.

Safety first:

• Pre-flight checks: Verifies administrative privileges, OS compatibility, and BCD access before making changes or querying system status.
• Automatic BCD Backup: Exports BCD state to a unique temporary file (WinSafeMode-Bcd-<guid>.bak) before any mutation.
• Post-Mutation Verification: Silently re-reads and verifies BCD configuration after every change.
• Automatic Cleanup: Removes temporary backup files upon successful verification.
• Structured Logging: Optional -LogPath parameter records execution details with precise timestamps and log levels.
• Seamless Elevation: Auto-detects privilege requirements and elevates via UAC while preserving all CLI switches (-Mode, -Silent, -ForceRestart, -NoRestart, -LogPath).
• Privilege Scope: Administrative elevation is required for -Mode Status, Minimal, Network, and Normal (due to BCD, BitLocker, and Secure Boot query permissions). Pure informational switches (-Version, -Help) execute under standard user rights.

---

Features

• Enable Safe Mode with Minimal configuration.
• Enable Safe Mode with Networking support.
• Restore Normal Mode by removing the safeboot BCD element.
• Detect current boot state (Normal Mode, Safe Mode - Minimal, Safe Mode - Networking, or Safe Mode - Other).
• Automatic BCD backup creation (New-BcdBackup) and verification with silent post-modification validation.
• BitLocker status detection using Get-BitLockerVolume cmdlet or CIM/WMI provider.
• Secure Boot & Firmware Type detection (UEFI vs Legacy BIOS via Get-ComputerInfo and Confirm-SecureBootUEFI).
• Execution logging to file via -LogPath.
• Silent execution (-Silent) for background scripts and automation.
• Flexible restart control: immediate restart (-ForceRestart) or delayed restart (-NoRestart).
• Machine-readable JSON output for status queries (-Json with -Mode Status).
• Professional console interface with interactive status card and ASCII framing.

---

Requirements

Component	Requirement
Operating System	Windows 10 or Windows 11 (Win32NT platform)
PowerShell	5.1 or 7.x+
Privileges	Administrator required for Status, Minimal, Network, Normal; Standard user for Version, Help
Dependencies	Built-in Windows system tools (bcdedit.exe, shutdown.exe)

BitLocker status prefers the native Get-BitLockerVolume cmdlet and gracefully falls back to the CIM/WMI provider (Win32_EncryptableVolume). Secure Boot checks BIOS firmware type via Get-ComputerInfo to handle Legacy BIOS environments before querying Confirm-SecureBootUEFI.

---

Installation

Clone the repository:

git clone https://github.com/AmrKhalid-dev/Win-Safe-Mode.git
cd Win-Safe-Mode

Run the script directly:

.\WinSafeMode.ps1

No external PowerShell modules or third-party packages are required.

---

Usage

Display Help

.\WinSafeMode.ps1 -Help

Displays command usage, available switches, and practical CLI examples.

Check Version

.\WinSafeMode.ps1 -Version

Interactive Mode

Launch without -Mode to open the interactive menu:

.\WinSafeMode.ps1

Interactive options:

• 1 : Enable Safe Mode - Minimal
• 2 : Enable Safe Mode - Networking
• 3 : Restore Normal Mode
• 4 : Exit

Interactive Flow: Banner → System Status Card → Menu Selection → Operation Execution → BCD Backup → Mutation → Post-Verification → Restart Prompt.

---

Direct Command-Line Modes

Check System Status (Requires Administrator)

# Human-readable output
.\WinSafeMode.ps1 -Mode Status

# Machine-readable JSON output
.\WinSafeMode.ps1 -Mode Status -Json

Enable Safe Mode (Minimal)

# Prompts for restart after change
.\WinSafeMode.ps1 -Mode Minimal

# Save change without restarting
.\WinSafeMode.ps1 -Mode Minimal -NoRestart

# Change mode and restart Windows immediately
.\WinSafeMode.ps1 -Mode Minimal -ForceRestart

Enable Safe Mode (Networking)

.\WinSafeMode.ps1 -Mode Network
.\WinSafeMode.ps1 -Mode Network -ForceRestart

Restore Normal Mode

.\WinSafeMode.ps1 -Mode Normal
.\WinSafeMode.ps1 -Mode Normal -NoRestart

---

Silent Execution

The -Silent switch suppresses normal console banners and status cards. It requires an explicit -Mode:

.\WinSafeMode.ps1 -Mode Minimal -Silent -NoRestart
.\WinSafeMode.ps1 -Mode Normal -Silent -ForceRestart

---

File Logging

Log execution steps, warnings, and errors to a specified log file using -LogPath:

.\WinSafeMode.ps1 -Mode Minimal -LogPath "C:\Logs\WinSafeMode.log"
.\WinSafeMode.ps1 -Mode Normal -Silent -ForceRestart -LogPath "C:\Logs\WinSafeMode.log"

The tool automatically creates the directory and file if they do not exist.

---

Parameters

Parameter	Type	Description
-Mode	String	Specifies operation mode: Minimal, Network, Normal, or Status.
-Silent	Switch	Suppresses console banner and interactive output. Requires -Mode.
-ForceRestart	Switch	Restarts Windows immediately (shutdown.exe /r /t 0) after verified change.
-NoRestart	Switch	Saves boot configuration change without initiating a restart.
-Json	Switch	Returns machine-readable JSON output (only applicable with -Mode Status).
-LogPath	String	File path for writing operational logs (INFO, SUCCESS, WARNING, ERROR).
-Help	Switch	Displays command-line usage and parameter descriptions.
-Version	Switch	Displays current tool version (v1.0.0).

Note: -ForceRestart and -NoRestart cannot be used together. Additionally, restart switches cannot be used with -Mode Status. The -Json switch is only valid with -Mode Status.

---

Logging & Diagnostics

When -LogPath is provided, all operations record structured log entries in UTF-8 format:

[2026-08-13 21:00:00] INFO     BCD backup created: C:\Users\...\AppData\Local\Temp\WinSafeMode-Bcd-a1b2c3d4.bak
[2026-08-13 21:00:01] SUCCESS  Safe Mode - Minimal was enabled successfully.
[2026-08-13 21:00:01] INFO     Temporary BCD backup removed: C:\Users\...\AppData\Local\Temp\WinSafeMode-Bcd-a1b2c3d4.bak

Log Levels used: INFO, SUCCESS, WARNING, ERROR.

---

Safety & Security

1. Targeted Scope: Modifies only the {current} boot entry via official bcdedit.exe commands.
2. Pre-flight Privilege Check: Ensures administrative rights before initiating modification or querying status.
3. Automatic Export Backup: Creates a unique BCD backup file (WinSafeMode-Bcd-<guid>.bak) in the system temp folder prior to any change.
4. Verification Step: Re-reads BCD configuration after modification to confirm that safeboot matches the intended state.
5. Backup Cleanup: Automatically removes temporary backup files once post-modification verification succeeds.
6. BitLocker & Secure Boot Awareness: Queries BitLocker protection and Secure Boot state to alert users to potential recovery key requirements before rebooting.

---

Exit Codes

Exit Code	Name	Description
0	Success	Operation completed and verified successfully.
1	GeneralError	Fatal error, unsupported OS, or system restart command failure.
2	InvalidUsage	Invalid parameter combination or missing required argument (e.g. -Silent without -Mode).
3	ElevationError	Could not acquire Administrator rights during UAC elevation.
4	BcdError	Unable to read or execute bcdedit.exe commands.
5	VerificationError	BCD was modified, but state post-verification failed.

---

Architecture Workflow

CLI Parameters (-Mode, -Silent, -ForceRestart, -NoRestart, -Json, -LogPath, -Help, -Version)
 ↓
Validation (Parameter conflict checks, OS Platform verification)
 ↓
Help / Version Check (-Help / -Version early exit for Standard Users)
 ↓
Elevation Check (Version/Help = Standard User; Status/Minimal/Network/Normal = UAC Elevation)
 ↓ Preserves CLI Flags (-Mode, -Silent, -ForceRestart, -NoRestart, -LogPath)
System Status Query (Get-CurrentBootMode, Get-BitLockerStatus, Get-SecureBootStatus)
 ↓
Operation Execution (Set-SafeBootMode / Set-NormalBootMode)
 ↓
Backup Phase (New-BcdBackup -> bcdedit /export temp file)
 ↓
Mutation Phase (bcdedit /set {current} safeboot [mode] or /deletevalue {current} safeboot)
 ↓
Verification Phase (Get-CurrentBootMode silent re-check -> Remove-BcdBackup on success)
 ↓
Restart Handling (Invoke-WindowsRestart or NoRestart delay)
 ↓
Exit Code Generation (0-5)

---

Screenshots

Main Interactive Menu

Operation Process

---

Troubleshooting

Privilege / UAC Elevation

• Running -Mode Status, -Mode Minimal, -Mode Network, or -Mode Normal requires Administrator privileges.
• Standard users attempting execution will trigger UAC elevation. If UAC is disabled or restricted, start PowerShell explicitly as Administrator.

BCD Verification Errors (Exit Code 5)

• If verification fails post-mutation, review system boot status with .\WinSafeMode.ps1 -Mode Status before restarting.
• Check if third-party security software or Group Policy blocks BCD modifications.

BitLocker Recovery Prompt Warning

• Changing boot configurations on volumes with BitLocker active may trigger a recovery key prompt upon reboot. Ensure your BitLocker Recovery Key is available before applying changes.

JSON Output

• When using -Json with -Mode Status, the output is machine-readable JSON that can be parsed by scripts and automation tools.
• The JSON output includes version information, boot mode, BitLocker status, Secure Boot status, and firmware type.

---

Security Policy

For security handling, privilege requirements, and vulnerability disclosure, refer to SECURITY.md.

---

License

This project is licensed under the MIT License.

---

Author

Amr Khalid Al-Mosabi
GitHub: @AmrKhalid-dev