Удаляешь ветки:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot
Но, продвинутые могут нагуглить и потом восстановить нужные ветки.
Мой кулхацкер именно так и поступил, я снова удалил эти ветки и запретил этому пользователю изменять эти ветки.

Потом прочитав это:
DISABLING THE SAFE MODE BOOT ON WINDOWS XP BY EDITTING WINDOWS XP'S NTLDR.SYS FILE.

I bet whomsoever is reading through this tutorial would by now, be thinking..."Ain't this guy crazy???", "How the hell does he expect me to edit ntldr.sys.?", "What happens after editing the damn file and my computer refuses to boot?", Does that mean that I am in for a reformat?"......

The following tut will answer all those questions cos' I have test ran the whole procedure on my PC and it worked perfectly.

The process is done by editing NTLDR.SYS in hex mode. You will need a software called 010 editor. This is a hex/binary editor and it will enable you to edit any file you want in either binary of hex mode. Download this software from www.sweetscape.com/010editor/ and install it into your computer.

Secondly, Open windows explorer (Double click the My Computer icon on the desktop or Click start, goto run and type C:\Windows\explorer.exe\ to start Windows Explorer). Look at the file menu and click on tools. Click on Folder Options among the drop down menu and goto the VIEW TAB. Find and enable Show Hidden Files and Folders and also Find and disableHIDE PROTECTED OPERATING SYSTEM FILES (RECOMMENDED). Click on Apply and OK to exit the menu.

Then, goto your system's root drive (partition) which is usually C:\ (Unless otherwise renamed). You will find out that there are several other files in there which you most probably, have never seen before. Those are the protected system files and are not meant to be tampered. Now, find the ntldr.sys and right click and click on properties. Uncheck the read only option. Apply and OK.

Now, go back and launch the 010 editor. Click on file, Open and select the ntldr.sys file. You will see that this file has been opened in hex mode (All you will see there will be 0s and 1s and some letters here and there). At the options, click on SEARCH and select Find.

In the Find dialog box, click the Type menu and select Hex Bytes (h).
In the value field, enter CD 16 0F 85 09 . Then click Find All.
The found value should now appear in the bottom pane of the 010 Editor window. Click on the CD 16 0F 85 09 value, and then hit Ctrl+R on the keyboard.

Now locate the Value field in the Replace With portion of the Replace dialog box and enter CD 16 90 90 90 . Then click the Replace button.
If you receive a warning message that no more occurrences exist, click OK. Then click Close to exit from the Replace dialog box.
You should now see the new value, (CD 16 90 90 90), displayed in the lower pane of the 010 Editor window.
You can now close the editor. When prompted to save the changes to the ntldr file , click Yes. Then reboot the system.
Now if you hit F8 to interrupt the boot sequence, you’ll see the Safe Mode boot options but no keystrokes will be accepted. Instead, you’ll have to sit and wait 30 seconds for the Safe Mode boot options to timeout and for Windows to start normally or the OS simply wont respond to the F8 keystrokes. Anyone now trying to access safe mode will have 30 seconds to bang on the keyboard and turn red while they wait.