Using GetSystemMetrics function, we can detect how the system is started.
function WindowsStartUpState: string;
begin
case (GetSystemMetrics(SM_CLEANBOOT)) of
0: Result := 'Normal boot';
1: Result := 'Fail-safe boot';
2: Result := 'Fail-safe with network boot';
else
Result := 'Unknown state';
end;
end;