What does BSOD 169 (BOOTING_IN_SAFEMODE_NETWORK) mean?

 
Previous Next
BOOTING_IN_SAFEMODE_MINIMAL BOOTING_IN_SAFEMODE_DSREPAIR

BOOTING_IN_SAFEMODE_NETWORK

Safe Mode networking boot marker for BOOTING_IN_SAFEMODE_NETWORK

BOOTING_IN_SAFEMODE_NETWORK is bug check code 0x000000A9. This value indicates a Safe Mode path that includes the networking stack. It helps separate crashes caused by core boot components from crashes that appear only when network miniports, protocol drivers, or services are loaded.

How to read it in a dump

  • If minimal Safe Mode works but networking Safe Mode fails, network drivers and filters become stronger suspects.
  • The marker is contextual; the stack and boot log identify the real failure.
  • NDIS, Winsock providers, VPN, firewall, and endpoint filters may still be relevant.

What to check

  • Compare minimal and networking Safe Mode.
  • Check NDIS miniports, VPN/firewall filters, and boot-time network services.
  • Collect boot logs to see which network components loaded before the failure.

References

Dump evidence

Preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “The system is booting in safemode - Minimal Services with Network”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.

Analysis order

  • Run WinDbg !analyze -v, then inspect the documented meaning of each parameter instead of relying only on the probably-caused-by line.
  • find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with booting / in / safemode / network.
  • keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.

Do not repeatedly reboot a machine affected by this result before collecting the dump and event logs. Recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.

Looking for a different code? Search another status or error code.