By default on Windows 2000, 2003, XP an NTFS volume will have its Change Journal
disabled. A service on an application (usually backup software) must explicitly activate the journal.
On Vista and Windows 2008, the Change Journal is active by default. Any application can activate or disable the volume's journal at any time but note that on Vista and Windows 2008, if the Change Journal is deactivated, it is automatically reactivated by the system.
Safe mode should (and apparently does) allow you to change the journal. As far as which services use the journal; indexing, VSS, block level backup, link tracking,antivirus software are all likely candidates. I would also guess that the new autorepair functionality uses it as well. I'd hesitate to change the journal size (especially increasing it). The change Journal is a sparse file and is purged as needed. HTe journal will grow beyhond whatever size you set automatically then purge it back down (from Creating, Modifying, and Deleting a Change Journal:
MaximumSize is the target maximum size for the change journal in bytes. The change journal can grow larger than this value, but at NTFS file system checkpoints the NTFS file system examines the journal and trims it when its size exceeds the value of MaximumSize plus the value of AllocationDelta. (At NTFS file system checkpoints, the operating system writes records to the NTFS file system log file that allow the NTFS file system to determine what processing is required to recover from a failure.)