Ventoy 0x1A Security Violation: Enroll the Key Safely

Short answer: On a PC with Secure Boot on, the first time you boot a Ventoy USB drive you are expected to see Verification failed: (0x1A) Security Violation. It is the first screen of Ventoy's documented key enrollment. Press OK, then any key to open MOK management, choose Enroll key from disk, select ENROLL_THIS_KEY_IN_MOKMANAGER.cer on the Ventoy drive, choose Continue and Yes, then Reboot. You do this once per computer, and again after updating from a Ventoy older than 1.1.14, which uses a new key. If a different error appears instead, Ventoy's advice is to turn off its Secure Boot option and disable Secure Boot in the firmware.

Official-source review — 8 November 2026 UTC: We checked Ventoy's About Secure Boot page (including the enrollment animation and the firmware screenshots on it, frame by frame), the downloads page, the Delete Ventoy Secure Boot Key page, the Global Control Plugin and Plugin Entrypoint pages, the Ventoy release news up to 1.1.18, and SecureBoot.md in the Ventoy GitHub repository. On Microsoft's side we read KB5062710, the Linux distribution guidance for the 2023 certificates, "Secure the Windows boot process", "Disabling Secure Boot" and the BitLocker recovery overview. We did not boot Ventoy, enroll a key or change Secure Boot settings on any PC. GitHub issue pages did not load for us today, so we used none.

Why does Ventoy show "Verification failed: (0x1A) Security Violation"?

Ventoy's boot menu is built on GRUB 2. Ventoy's Secure Boot policy document explains that because GRUB 2 is GPL-licensed, Ventoy's GRUB is not signed with a UEFI certificate. Like most Linux distributions, it has to be started by shim. Ventoy has no shim of its own, so it uses a third-party one.

That shim does not trust Ventoy's GRUB until you enroll Ventoy's key in MokManager. After that, shim accepts it on that computer. The About Secure Boot page shows the 0x1A screen as step one of its enrollment animation, so seeing it once is normal.

How to fix the 0x1A error: enroll Ventoy's key in MokManager

These steps follow the screens in the animation on Ventoy's About Secure Boot page. The animation was recorded on an older Ventoy in a virtual machine.

Boot from the Ventoy USB drive with Secure Boot on. When you see ERROR — Verification failed: (0x1A) Security Violation, press Enter on OK.
The Shim UEFI key management screen says "Press any key to perform MOK management" and counts down from 10 seconds. Press a key before it runs out.
In Perform MOK management, choose Enroll key from disk. Do not pick "Enroll hash from disk".
Under Select Key, pick the Ventoy volume, shown as VTOYEFI.
In the file list (grub/, ventoy/, EFI/, tool/), select ENROLL_THIS_KEY_IN_MOKMANAGER.cer.
On [Enroll MOK], choose Continue.
At Enroll the key(s)?, choose Yes.
Back in Perform MOK management, choose Reboot. Boot from the USB drive again. The Ventoy menu should now appear.

The Select Key screen itself warns that any binaries signed with the enrolled key "will be run without prompting" and tells you to make sure it is a genuine key. Only enroll the .cer file on your Ventoy drive's VTOYEFI volume, and only on a drive made with Ventoy from an official source. Our Ventoy page lists the current release and its SHA-256 values, and our SHA-256 checker can hash the ZIP in your browser.

Why did the error come back after I updated Ventoy?

Because the key changed. The Ventoy release news says 1.1.14 (24 June 2026) updated the Secure Boot shim "to solve the UEFI CA 2023 issue" and uses a new CA, so "you need to enroll the new key for the first boot." Version 1.1.13 was "deprecated due to a mistake", and the 1.1.15 notes repeat that a new key is used since 1.1.14. The About Secure Boot page puts it as "Ventoy 1.1.13+".

So if you enrolled a key with an older Ventoy, a drive updated to 1.1.14 or later shows the 0x1A screen again on that PC. Run the same eight steps once more. The current release on the news page is 1.1.18, from 9 October 2026.

The old key stays enrolled unless you remove it. Ventoy's Delete Ventoy Secure Boot Key page links a tool called ventoy-delete-key: you copy it to the Ventoy drive, boot it through Ventoy and follow the steps shown on that page.

Is this related to the 2026 Secure Boot certificate rollover?

Yes. Microsoft's KB5062710 lists the Microsoft UEFI CA 2011, which "signs third-party boot loaders and EFI applications", as expiring on 27 June 2026. It is replaced by the Microsoft UEFI CA 2023. Our Secure Boot certificates 2026 guide shows how to check which certificates your PC has.

Microsoft's guidance for Linux distributions describes the problem from both sides:

A shim signed only with the 2011 CA "will fail Secure Boot validation on devices that trust only the 2023 CAs."
A shim signed only with the 2023 CA will not boot on devices that still trust only the 2011 CA.

Ventoy's answer is in SecureBoot.md: it chose a shim from Rocky Linux "because it was signed with both UEFI CA 2011 and UEFI CA 2023." In practice: update Ventoy on the drive, then enroll the new key once.

What if the enrollment screen never appears?

Some PCs block Ventoy before shim can open MokManager. Ventoy's About Secure Boot page starts with a note: on some computers you must enable Allow Microsoft 3rd Party UEFI CA in the firmware for Ventoy to boot. Its screenshots show the setting under different names:

Third-party CA setting in firmware screenshots on Ventoy's About Secure Boot page
Maker (example shown)	Setting name in the screenshot
Lenovo ThinkPad	Security > Secure Boot Configuration > Allow Microsoft 3rd Party UEFI CA
Microsoft Surface	Change Secure Boot configuration > Microsoft & 3rd party CA
HP	Secure Boot Configuration > Enable MS UEFI CA key
Dell	Boot Configuration > Enable Microsoft UEFI CA

Microsoft's Secure the Windows boot process explains why: Secured-core PCs ship set to distrust the Microsoft 3rd Party UEFI CA by default, and you enable it under Security > Secure Boot in the firmware. Microsoft also notes that this CA signs the boot loaders for all Linux distributions, so trusting it increases the attack surface. If you only need Ventoy now and then, switch it back off afterwards.

Other error screens: SBAT, SHIM_LOCK and "Linpus lite"

Ventoy's About Secure Boot page is direct about its limits: "the solution is not perfect enough." If you get an error screen instead of the blue enrollment screen, with "Linpus lite" as its example, the Secure Boot solution does not work with your machine. Ventoy's advice is to turn off the Secure Boot option in Ventoy and disable Secure Boot in the BIOS.

Some older errors were fixed in releases. The release news says 1.1.00 updated the shim to fix "verifying shim SBAT data failed", and 1.0.99 updated the EFI boot files to fix the "Linpus Lite" error on some computers. If you see either message, update the drive to the current Ventoy first.

We found no mention of a "Verifying shim SHIM_LOCK protocol" message in Ventoy's documentation or release news. We are not going to guess what causes it in your case. The safe order is the same: update Ventoy, try the enrollment again, and fall back to the temporary Secure Boot route below if it still fails.

When is it OK to disable Secure Boot temporarily?

When enrollment does not work on your PC and you need the drive now. Treat it as temporary.

Get your BitLocker recovery key first if your Windows drive is encrypted. Microsoft's BitLocker recovery overview lists firmware upgrades, boot manager changes and changes to the TPM's PCR measurements among the events that can trigger recovery.
Turn off Ventoy's Secure Boot Support (Option > Secure Boot Support in Ventoy2Disk.exe, -s for Ventoy2Disk.sh), as Ventoy advises when its solution fails on your machine.
Open the firmware menu. Microsoft's Disabling Secure Boot page says you can press a key such as F1, F2, F12 or Esc at startup, or hold Shift while selecting Restart in Windows and go to Troubleshoot > Advanced Options: UEFI Firmware Settings.
Set Secure Boot to Disabled. Microsoft says it is usually on the Security, Boot or Authentication tab. Save and exit.
Turn Secure Boot back on when you are done. On some PCs you choose Custom and load the built-in keys. If the PC will not start after re-enabling, Microsoft says to disable it again, and to contact your PC maker if you still cannot use Secure Boot.

Microsoft warns you may need to restore the PC to its factory state to turn Secure Boot back on. If your goal is only a single Windows installer rather than a multi-ISO drive, see our guide to installing Windows 11 25H2 on an unsupported PC and our Rufus page.

What enrolling Ventoy's key does not do

Enrolling the key does not mean every file on the drive is now checked by Secure Boot. Ventoy's About Secure Boot page states: "Ventoy default policy is fully bypass secure boot which means all EFI files can be booted without any check." SecureBoot.md says this mode carries risks because Secure Boot is effectively bypassed.

If you want Ventoy to follow your firmware's Secure Boot rules instead, set VTOY_SECURE_BOOT_POLICY to 1 in the Global Control Plugin. The Plugin Entrypoint page says the file is ventoy.json, in a folder named ventoy on the drive's first partition:

{
    "control":[
        { "VTOY_SECURE_BOOT_POLICY": "1" }
    ]
}

With policy 1, only EFI files signed with a UEFI CA, such as the Windows boot manager or another shim, will boot. Ventoy says some features, such as grub2boot mode, are disabled in this mode, but it is the most secure.

This is not a claim that Ventoy is unsafe. Our Is Ventoy safe? page covers the binary blob debate and how to verify a download. If you mainly need one installer per drive, our Ventoy vs Rufus vs balenaEtcher comparison may point you to a simpler tool. Get Ventoy through ventoy.net's download page, which sends you to its SourceForge files and asks you to check the SHA-256 hash; see our guide to fake download sites.

Questions

Do I have to enroll the Ventoy key on every computer?

Yes, once per computer. Ventoy's About Secure Boot page says the steps "only need to be done once for each computer."

Do I need to enroll again for every new ISO?

No. The key is for Ventoy's boot loader, not for each ISO. You enroll again only when the Ventoy key itself changes, as it did in 1.1.14.

Will this work for Linux distributions like Bazzite or Linux Mint?

Enrollment only lets Ventoy itself start. Whether an ISO then boots depends on the image and on Ventoy's policy setting. For distro choices, see Bazzite vs SteamOS and our guide to alternatives for PCs that can't run Windows 11.

Can I remove the Ventoy key from my PC later?

Yes. Ventoy's Delete Ventoy Secure Boot Key page links the ventoy-delete-key tool for this. You copy it to the Ventoy drive, boot it through Ventoy and follow the steps shown on that page.

Ventoy 0x1A Security Violation: How to Fix It With Secure Boot On