We have a problem where servers sometimes reboot into safe mode and no one knows about it until they go and login.
So I'm looking for a way to monitor and alarm when a server boots into safemode.
Has anyone got anything like this running or can think how to do it?
I was trying to monitor for vmci event logs as this service fails to start when in safemode. Not having any luck with this yet though.
Create a powershell script with "gwmi win32_computersystem | select BootupState". This will return one of the following messages:
"Fail-safe with network boot"
If you filter for "Fail-safe" you will get a T/F result if the system is running in safe mode. You can also redirect this to a file and proceed based on whether the file contains "Fail-safe", or use vbscript to query the WMI object above and directly return a result.
I have a script that is scheduled to run 15 minutes after boot via the task scheduler. If it detects safe mode via the above WMI query, it writes an event to the event log that can easily be monitored by Kaseya. The script and scheduled task is deployed via our Agent First Check-in procedure. The 15 minute delay is usually enough to have a server boot through safe-mode to correct a problem and then boot normally without throwing an alert.
There are several ways to get this done by using that WMI object.
Ok I just created an Event Log alert for when there is event ID '2' source is 'vmci' and description is 'VMCI: Not supported in Safe Boot Mode.'. Obviously this only works in a VMware environment but yeah.
Does what I need I guess, if someone has anything better, perhaps with some automatic remediation please let me know.
Thanks Glenn that's excellent advice should get me on the right track.
Appreciate your response and the detail you went to.