any idea that event detail can come on mail when any user try to login the system on safe mode with networking?
Check this thread
https://www-secure.symantec.com/connect/forums/report-system-running-safe-mode#comment-10177971