Ventoy Not Booting Windows 11? Fix Security Violation, Secure Boot and Driver Errors

Ventoy is the easiest way to carry Windows 11, a couple of Linux ISOs and a rescue disk on one USB stick: you install it once, then just copy ISO files onto the drive. When it works, it is brilliant. When it doesn't, you get a blue screen saying "Verification failed: (0x1A) Security Violation", a Windows Setup window complaining that no device drivers were found, or a black screen right after you pick the ISO.

Each of those has a specific cause, and most of them changed in 2026. Ventoy switched to a new Secure Boot certificate in June (version 1.1.14), so a stick that booted fine last year can fail on a new laptop today. This guide goes error by error, with the exact fix for each, based on Ventoy's own documentation and release notes up to version 1.1.18 (9 October 2026).

Short version: update the stick to the latest Ventoy, enrol the new key once when the blue MokManager screen appears, make sure "Allow Microsoft 3rd Party UEFI CA" is enabled in the BIOS, and if Windows Setup still fails, press Ctrl+W on the ISO to boot it in WIMBOOT mode.

Quick fix table: Ventoy Windows 11 errors

"Verification failed: (0x1A) Security Violation" - enrolling Ventoy's key

This is the error people search for most, and it is usually not a fault. Ventoy is built on GRUB2, which is GPL-licensed, so it can't be signed directly by Microsoft. Instead it boots through a shim, a small loader that is signed. On a PC with Secure Boot turned on, the shim checks Ventoy and refuses it until you tell the PC to trust Ventoy's key. That refusal is the blue "Security Violation" screen.

You fix it once per computer:

1. On the blue "Verification failed: (0x1A) Security Violation" screen, press OK (Enter). This opens MokManager.
2. Choose Enroll key from disk.
3. Select the small VTOYEFI partition, then the file ENROLL_THIS_KEY_IN_MOKMANAGER.cer.
4. Choose Continue, then Yes to enrol the key.
5. Choose Reboot. Boot from the USB again and the Ventoy menu appears.

Ventoy's documentation shows this as an animation, not text, and the wording in MokManager can differ slightly between firmware. The order is always the same: key from disk, the VTOYEFI partition, the .cer file, continue, yes, reboot.

"Enroll key" vs "Enroll hash": enrolling the key trusts everything Ventoy signs with it, so it survives Ventoy updates that keep the same key. Enrolling a hash trusts one exact file, and breaks again the next time that file changes. Use the key.

If MokManager freezes on "Enroll key from disk", it is almost always the firmware, not the stick. Try a USB 2.0 port or a different stick. Or turn Secure Boot off, boot what you need, and turn it back on.

Secure Boot support must be switched on in Ventoy2Disk

Ventoy enables Secure Boot support by default (since version 1.0.76). If someone installed the stick with it turned off, the shim isn't there and you'll never see MokManager. In Ventoy2Disk.exe, check Option → Secure Boot Support and reinstall or update the stick (on Linux, Ventoy2Disk.sh uses the -s option).

The 2026 certificate change: why an old Ventoy stick stopped booting

Microsoft's original Secure Boot certificates, from 2011, are being replaced by 2023 versions. New PCs and firmware updates increasingly trust only the 2023 certificates. Ventoy responded in June 2026:

• 1.1.14 (24 June 2026) - "Update secure boot shim file to solve the UEFI CA 2023 issue." Ventoy now uses a shim from Rocky Linux that is signed with both the 2011 and 2023 CAs. Because it is a new CA, you have to enrol the new key on first boot, even on a PC where you enrolled Ventoy's key before.
• 1.1.13 was released the same day and withdrawn ("deprecated due to a mistake"). If your stick reports 1.1.13, update it. Ventoy's Secure Boot page mentions 1.1.13 for this change, but the release notes put it in 1.1.14.
• 1.1.15 and 1.1.16 (25 June 2026) fixed boot problems when Secure Boot is disabled, including on older UEFI firmware.
• 1.1.17 (24 July 2026) - "Optimization for Secure Boot process."
• 1.1.18 (9 October 2026) - "Fix the Windows/WinPE secure boot version check failed issue."

So if a Ventoy stick from 2025 fails on a new laptop with a Security Violation, update the stick in place (Ventoy2Disk → Update, which keeps your ISO files), then enrol the new key once.

Enable "Allow Microsoft 3rd Party UEFI CA" in the BIOS

The shim Ventoy uses is signed by Microsoft's third-party UEFI CA, the same one Linux distributions use. Some PCs ship with only the Windows CA trusted, especially business laptops sold as "Secured-core PCs" (many ThinkPads, Surface devices and some HP and Dell models). On those, Ventoy's documentation is explicit: you must enable the Allow Microsoft 3rd Party UEFI CA option in the firmware, or Ventoy will not boot.

The setting lives under Security → Secure Boot on most firmware. If you get a firmware error screen instead of the blue MokManager screen and can't find that option, Ventoy's advice is to turn off Secure Boot Support in Ventoy2Disk and disable Secure Boot in the BIOS.

VTOY_SECURE_BOOT_POLICY: bypass or follow

Once Ventoy itself has booted, it has two policies, set in /ventoy/ventoy.json:

{
    "control": [
        { "VTOY_SECURE_BOOT_POLICY": "0" }
    ]
}

• "0" (default) - bypass the check, so any ISO boots, signed or not.
• "1" - follow the firmware's Secure Boot policy, so only files signed with a UEFI CA boot (Windows' bootmgr, signed Linux shims). This also disables some Ventoy features, including GRUB2 mode.

If you have "1" set and an unsigned ISO won't boot, that's the setting working as intended.

"No device drivers were found" and "A media driver your computer needs is missing"

Here Ventoy has done its job, because Windows Setup is running. The failure is the next step: Setup can't find the installation files. Ventoy presents the ISO as an emulated CD drive. Some hardware and some ISO builds don't work well with that.

1. Boot the ISO in WIMBOOT mode. In the Ventoy menu, highlight the Windows ISO and press Ctrl+W (since 1.0.80 you can also press just W, or pick it from the secondary menu), then Enter. WIMBOOT loads Windows Setup a different way. Ventoy recommends it exactly for this case, "when you run into problem with the default mode", and it works with official Windows ISOs and some WinPE ISOs.
2. Change the port. Try a USB 2.0 port, or a port directly on the motherboard instead of a hub or front panel.
3. Check the ISO. A corrupted download produces the same message. In the Ventoy menu, press M on the ISO to show its checksum, and compare it with the hash from Microsoft's download page.

Setup starts but no drive is listed

If Setup gets to "Where do you want to install Windows?" and the list is empty, the problem is the target disk, not the USB. On many Intel laptops the NVMe drive sits behind Intel VMD (Volume Management Device), and Windows Setup has no driver for it. Either copy the Intel RST VMD driver from the laptop maker's site onto the Ventoy stick and use Load driver, or change the storage mode from RAID/VMD to AHCI in the BIOS. Don't do the second one on a machine with an existing Windows install you want to keep, because it may not boot afterwards.

Windows 11 TPM and Secure Boot check: Ventoy bypasses it by default

If Setup says "This PC can't run Windows 11", Ventoy is supposed to prevent it. Its global control plugin has two Windows 11 options, both on by default since version 1.0.86:

• VTOY_WIN11_BYPASS_CHECK - creates the BypassTPMCheck, BypassSecureBootCheck, BypassRAMCheck and BypassCPUCheck values under HKLM\SYSTEM\Setup\LabConfig before Setup runs.
• VTOY_WIN11_BYPASS_NRO - lets you create a local account instead of a Microsoft account. Disconnect the network during setup, or the local-account option won't appear.

{
    "control": [
        { "VTOY_WIN11_BYPASS_CHECK": "1" },
        { "VTOY_WIN11_BYPASS_NRO": "1" }
    ]
}

If you still get the hardware check, look for a ventoy.json that sets either value to "0". Also check the ISO itself, because the bypass is only available for standard Windows 11 ISO files. Modified or repackaged ISOs may not get it. Windows 11 still runs on unsupported hardware after the bypass, but Microsoft doesn't support that setup and may withhold some updates.

Black screen after selecting the ISO

A black screen (sometimes with a blinking cursor) means the ISO's own boot loader started and then lost the display or stalled. Ventoy has three alternative boot modes. Press the key on the highlighted ISO before Enter, and press it again to go back to normal mode:

For Windows, try WIMBOOT first. For Linux, try GRUB2 mode, then the distribution's own "safe graphics" or nomodeset boot entry. If the screen is fuzzy or at the wrong resolution rather than black, VTOY_WIN_UEFI_RES_LOCK in the control plugin sets the resolution used for Windows.

Ventoy vs Rufus vs YUMI vs Easy2Boot

If Ventoy keeps fighting a particular PC, it helps to know what else does the same job:

A practical approach: keep a Ventoy stick for everything, and use Rufus to make a dedicated Windows 11 installer for the one machine Ventoy won't cooperate with.

Is Ventoy safe to use?

Ventoy is open source (GPLv3) and widely used. In 2024 some users raised concerns on GitHub about precompiled binary files in the repository, after the xz backdoor made people more careful about this. Two sensible habits: download only from ventoy.net or the official GitHub releases page, and compare the SHA-256 hash of the download with the one published there. Secure Boot policy "0" (the default) means Ventoy will boot unsigned images, so only put ISOs on the stick that come from sources you trust.

Checklist before you give up

1. Update the stick to the latest Ventoy (1.1.18 or newer) with Update, not Install, so your ISOs stay.
2. Enrol the key once on each PC, and again after moving to 1.1.14+.
3. Enable "Allow Microsoft 3rd Party UEFI CA", or disable Secure Boot temporarily.
4. Press Ctrl+W on the Windows ISO.
5. Verify the ISO's checksum with M.
6. Use another USB port, then another stick.

If you're setting up machines for a small office and want the Windows side done properly (drivers, updates, backups), or need a website built or fixed, that's the kind of work I do. See how to hire me. For everyday file jobs that don't need any of this, the free online tools list runs in the browser with nothing to install.