Exit a Windows boot loop caused by a persistent Safe Mode setting

Windows repeatedly starts in Safe Mode, attempts Safe Mode and fails, or cannot return to normal startup after Safe boot was enabled through System Configuration or BCDEdit.

Searchable Windows error codes and exact messages

There is no Windows error code assigned to a persistent safeboot BCD setting. Search using the behavior and the setting that Windows exposes:

If a blue-screen or Recovery code appears while forced Safe Mode is trying to start, that code identifies a second boot failure, not the persistent Safe Mode setting. Do not add an unrelated stop code to this diagnosis merely because the machine happens to be in a Safe Mode loop.

Use this procedure when the active Windows loader contains the BCD element safeboot. It covers minimal, network, and alternate-shell Safe Mode configurations.

Do not use it merely because Windows automatically entered recovery after failed boots. Automatic Recovery and a persistent safeboot BCD value are different conditions.

The reason Safe Mode was enabled, the exact Windows build, and the hardware model may remain unknown. The procedure must still confirm that safeboot is actually present.

Use either:

• An administrator Command Prompt from the Safe Mode desktop, or
• Windows Recovery Environment Command Prompt if Safe Mode itself will not load

If the Safe Mode desktop works, use the Working Safe Mode branch. If it does not, select Troubleshoot > Advanced options > Command Prompt and use the WinRE branch.

Working Safe Mode branch

1. Open an administrator Command Prompt.

2. Run:

   bcdedit /enum {current} /v
   

3. Confirm that the output includes a line beginning with safeboot.

WinRE branch

1. Detect the partition layout:

   diskpart
   list disk
   list volume
   exit
   

2. On a GPT/UEFI system, assign a temporary letter such as S to the small FAT32 EFI System Partition if it does not already have one:

   diskpart
   select volume <EFI-volume-number>
   assign letter=S
   exit
   

3. Enumerate the offline store:

   bcdedit /store S:\EFI\Microsoft\Boot\BCD /enum all /v
   

4. Read the default value under Windows Boot Manager, then find the matching Windows Boot Loader identifier. Confirm that loader contains safeboot.

5. For a BIOS/MBR installation, assign S to the detected System Reserved or active system partition and use this store instead:

   bcdedit /store S:\Boot\BCD /enum all /v
   

If the Safe Mode desktop works

1. Back up the BCD:

   md C:\BootRepairBackup
   bcdedit /export C:\BootRepairBackup\BCD-before-safeboot-removal
   

2. Remove the Safe Mode requirement:

   bcdedit /deletevalue {current} safeboot
   

3. If /enum {current} also displayed safebootalternateshell, remove it:

   bcdedit /deletevalue {current} safebootalternateshell
   

4. Run bcdedit /enum {current} again and confirm both elements are absent.

5. Restart normally.

If only WinRE works

1. Back up the detected BCD file to the Windows volume. In this example, the correct Windows installation is W::

   md W:\BootRepairBackup
   copy S:\EFI\Microsoft\Boot\BCD W:\BootRepairBackup\BCD-before-safeboot-removal
   

   For BIOS/MBR, copy S:\Boot\BCD instead.

2. Replace <loader-GUID> with the identifier established in section 7:

   bcdedit /store S:\EFI\Microsoft\Boot\BCD /deletevalue {<loader-GUID>} safeboot
   

3. If present, remove the alternate-shell value:

   bcdedit /store S:\EFI\Microsoft\Boot\BCD /deletevalue {<loader-GUID>} safebootalternateshell
   

4. For BIOS/MBR, substitute S:\Boot\BCD as the store path.

5. Enumerate the loader again and confirm the values are absent.

6. Close Command Prompt and select Continue to Windows.

• The command completed successfully: Restart and verify normal mode.
• Element not found: The specified loader did not contain that value. Confirm the correct store and GUID; do not start deleting other BCD settings.
• The store could not be opened: The assigned partition or BCD path is wrong. Re-run DiskPart detection.
• Windows still enters Safe Mode but safeboot is absent: Check System Configuration after boot and confirm that another loader is not the default.

• Do not delete the entire loader entry.
• Do not set bootstatuspolicy ignoreallfailures or disable recovery.
• Do not rebuild the complete BCD when removing one value is sufficient.

Safe Mode can be re-enabled later through System Configuration > Boot > Safe boot if it is intentionally needed. Do not import the old BCD merely to re-enable Safe Mode because that could also restore unrelated obsolete settings.

• Windows reaches the normal desktop.
• winver opens normally.
• bcdedit /enum {current} no longer lists safeboot.
• A second restart also reaches normal mode.

Confidence is approximately 95% when the active loader explicitly contains safeboot. Stop if the value is absent, the offline BCD store cannot be positively identified, or multiple intentional Windows loaders cannot be distinguished.