BSOD 168 (BOOTING_IN_SAFEMODE_MINIMAL): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: Windows recorded that it is booting in Safe Mode with minimal services.

Previous	Next
BAD_EXHANDLE	BOOTING_IN_SAFEMODE_NETWORK

BOOTING_IN_SAFEMODE_MINIMAL

Safe Mode minimal boot marker for BOOTING_IN_SAFEMODE_MINIMAL

BOOTING_IN_SAFEMODE_MINIMAL is bug check code 0x000000A8. This value is a boot-state marker rather than an ordinary driver fault. It is useful in crash output because it tells you that the failing boot path had most third-party services and many nonessential drivers disabled.

How to read it in a dump

Interpret the crash in the context of Safe Mode minimal service set.
A failure here often narrows the suspect set to boot-critical drivers, core services, storage, graphics fallback, or security components.
Do not treat the marker itself as the root cause.

What to check

Compare normal boot, Safe Mode minimal, and Safe Mode with networking behavior.
Focus on boot-start drivers and services that still load in minimal mode.
Preserve boot logs because they show which drivers were included or skipped.

References

Dump evidence

Preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “The system is booting in safemode - Minimal Services”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.

Analysis order

Run WinDbg !analyze -v, then inspect the documented meaning of each parameter instead of relying only on the probably-caused-by line.
find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with booting / in / safemode / minimal.
keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.

Do not repeatedly reboot a machine affected by this result before collecting the dump and event logs. Recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.

Looking for a different code? Search another status or error code.