You boot the Ventoy stick and, before any menu appears, a stark blue screen announces a security violation. This is not the Windows 11 check and not a broken stick — it is the PC's Secure Boot meeting Ventoy for the first time. One short enrolment fixes it permanently.
✍️ Technical Anshu🪟 Windows 11⏱️ 8 minute fix
🎥 Once enrolled, the same stick boots into the bypass install shown in the video
Two different things are both called Secure Boot in these guides, and mixing them up causes endless confusion. First: your PC's firmware checking whether Ventoy itself is allowed to run — that produces the 0x1A screen, before Windows is involved at all. Second: Windows 11 Setup checking whether the PC supports Secure Boot — that is the check Ventoy's bypass skips. This page is about the first one. Ventoy ships with a signed shim so it can run under Secure Boot, but on the first boot on a new PC you must tell the firmware to trust Ventoy's key. That one-time process is called key enrolment, and it happens in a small tool named MokManager.
UEFI Firmware — Secure Boot
Verification failed: (0x1A) Security Violation
👆 The 0x1A screen — do not panic and do not disable Secure Boot yet; enrolment takes about a minute (screen recreated with the real wording)
1
Enroll the Ventoy Key — Step by Step
On the blue screen, press Enter (OK) — the Shim UEFI key management screen (MokManager) opens
Choose Enroll key from disk
Select the VTOYEFI partition from the device list
Select the file ENROLL_THIS_KEY_IN_MOKMANAGER.cer
Choose Continue, then confirm with Yes when it asks whether to enroll the key
Choose Reboot. Boot from the Ventoy stick again — this time the Ventoy menu appears, with Secure Boot still switched on
2
Why This Is Safe — and When to Be Suspicious
You are enrolling Ventoy's own public key, which lets the firmware trust software signed by the Ventoy project. It does not disable Secure Boot and does not affect how Windows boots afterwards
Only ever do this with a stick you made yourself from the official ventoy.net download. A stranger's pre-made stick asking you to enroll a key deserves exactly the suspicion you are feeling
The enrolment is stored in the PC's firmware, per machine — expect to repeat it once on each new PC, and never again on the same one
3
The Alternative — Turning Secure Boot Off
Disabling Secure Boot in your BIOS/UEFI settings also gets Ventoy running, and for a one-off install on your own old PC it is a legitimate shortcut. But understand the trade: Secure Boot stays off for everything afterwards unless you re-enable it, and it is a genuine protection against boot-level malware. Enrolment keeps the protection and the stick working, which is why it is the recommended route. Note also that Windows 11's own Secure Boot requirement check is a separate matter — Ventoy's bypass handles that one during Setup regardless.
⚠️ Honest note: if MokManager never appears and the PC simply returns to the 0x1A screen or skips the USB entirely, check two mundane things before blaming Ventoy: the stick must be booted in UEFI mode (choose the UEFI entry for the USB in the boot menu), and some business laptops lock key enrolment behind a BIOS supervisor password or a Secure Boot mode set to Standard rather than Custom.
🎥 Watch the Full Ventoy Bypass Video
Key enroll karne ke baad stick seedha video wale bypass install flow me chala jata hai.
Is enrolling the Ventoy key the same as disabling Secure Boot?
No — it is close to the opposite. Secure Boot stays fully enabled; you are adding one trusted key so Ventoy's signed loader is accepted. Windows and everything else continue to boot under Secure Boot protection.
I enrolled the key but the screen came back on a different PC. Did it fail?
No. Enrolment is stored in each PC's own firmware, so a stick used across many machines meets this screen once per machine. It is a one-minute step per PC, not a fault.
Windows will not boot after I changed Secure Boot settings. What happened?
Ventoy enrolment alone cannot cause that. If you instead disabled Secure Boot or changed its mode while BitLocker was active, Windows may ask for the BitLocker recovery key at next boot — that is BitLocker reacting to the firmware change, and entering the key restores normal booting.
This guide is based on the Technical Anshu Ventoy Windows 11 bypass video • Stuck on a step? Ask in the video comments — you will get a reply 🙏