Fix ERROR_INSTALL_SERVICE_SAFEBOOT (0x00000674) in Safe Mode

Why You're Seeing This Error

The Windows Installer service (msiexec.exe) is designed to not start when Windows boots into Safe Mode. This isn't a bug — it's a safety feature. Safe Mode loads only essential drivers and services, and MSI (Windows Installer) isn't on that list. So when you double-click an .msi file or run an installer, you get 0x00000674 with the message: "The Windows Installer service is not accessible in Safe Mode."

This commonly happens when you're trying to uninstall a stubborn piece of software or install a driver while troubleshooting. There are three ways around it. I'll start with the one that works 90% of the time.

Cause #1: Safe Mode with Networking Still Blocks MSI

Most people assume "Safe Mode with Networking" includes the Windows Installer service. It doesn't. Both standard Safe Mode and Safe Mode with Networking leave msiexec disabled. The fix is to manually start the service from an elevated command prompt.

How to Fix

1. Boot into Safe Mode with Networking (or regular Safe Mode — doesn't matter).
2. Press Win + R, type cmd, then press Ctrl + Shift + Enter to run as Administrator.
3. Type this command and hit Enter:
   

   net start msiserver

4. If it starts successfully (you'll see "The Windows Installer service was started successfully"), run your installer or uninstaller right away.
5. After you're done, you can leave it running. It'll stop when you exit Safe Mode.

Real-world example: I've used this dozens of times to remove broken antivirus software that wouldn't uninstall in normal mode because it was already corrupted. Boot to Safe Mode, start msiserver, run the vendor's uninstaller — done.

If the service doesn't start with net start, you'll get error 2 or 1058. That leads us to the second cause.

Cause #2: Registry Key Blocks the Service

Windows uses a registry key to tell the Service Control Manager which services to skip in Safe Mode. That key is SafeBoot. If the Windows Installer service got flagged here (manually or by a group policy), it won't start even if you try net start.

How to Fix

1. Boot into Safe Mode with Command Prompt (or regular Safe Mode).
2. Open Registry Editor as Administrator (type regedit in an admin command prompt).
3. Navigate to:
   

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer

4. If the key exists, check the (Default) value. It should be Service. If it's something else or missing, set it to Service.
5. If the entire MSIServer key is missing, create it. Right-click Minimal → New → Key → name it MSIServer. Then set its (Default) to Service.
6. Close Registry Editor, then run net start msiserver again.

One more thing: If you're booting into Safe Mode with Networking, repeat the same steps under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer

I've seen group policies (especially on corporate machines) wipe out these keys during updates. Recreating them is a solid fix.

Cause #3: Corrupted Windows Installer Service Files

If neither of the above works, the msiexec binary or its dependencies are likely corrupted. This is rare but happens after failed updates or botched uninstalls.

How to Fix

1. Boot into normal mode (not Safe Mode).
2. Open an elevated Command Prompt (Admin).
3. Run the System File Checker:
   

   sfc /scannow

4. If SFC finds issues but can't fix them, run DISM next:
   

   DISM /Online /Cleanup-Image /RestoreHealth

5. Reboot and try Safe Mode again.

Why this matters: SFC replaces corrupt system files, and DISM fixes the component store that SFC relies on. I've fixed machines where msiexec itself was missing or corrupted. After running these two, the service started normally in Safe Mode.

If you're still stuck, you can try reinstalling the Windows Installer redistributable (WindowsInstaller-KB893803-v2-x86.exe for older systems), but on Windows 10/11, DISM handles this better.

Quick Reference Summary

Bottom line: Start with net start msiserver. It's quick, safe, and fixes the vast majority of cases. If that fails, check the registry. Only reach for SFC/DISM if you have to. You'll be in and out in under 5 minutes.