If you need to know how Windows was started you have just to call an API function: GetSystemMetrics. Passing the SM_CLEANBOOT constant as parameter, the function returns a Long value with this meaning:
0 = Normal boot
1 = Fail-safe boot
2 = Fail-safe with network boot
Here ia an example that shows how to call the function:
Private Declare Function GetSystemMetrics Lib "user32" (ByVal nIndex As Long) _
Public Const SM_CLEANBOOT = 67
Private Sub Command1_Click()
Select Case GetSystemMetrics(SM_CLEANBOOT)
Case 0: MsgBox "Normal boot"
Case 1: MsgBox "Fail-safe boot"
Case 2: MsgBox "Fail-safe with network boot"