You built the perfect rescue USB, plugged it into a modern PC, and got a security violation instead of a menu - or the menu opened and one stubborn ISO still refused. That is Secure Boot doing its job. Here is how it works with Ventoy, and how to get past it the documented way.
Secure Boot checks the signature of everything that tries to start your PC, and stops anything unrecognised. It is a genuine protection against boot-level malware, which is why the answer is never "just switch it off forever". Ventoy ships with Secure Boot support built in, but the very first boot on a new machine needs a one-time step - enrolling Ventoy's key - and even after that, a few rescue images carry signatures Secure Boot simply will not accept. Both facts are normal once you understand them.
Your PC's firmware holds a list of trusted signing keys. When something tries to boot, its signature is checked against that list: recognised, it starts; unrecognised, it is refused - instantly, and with an alarming message that gives no hints.
Ventoy is signed through the standard Linux shim route, which is why it can work with Secure Boot on. But your PC does not yet trust Ventoy's own key for loading the ISO files, so on first contact the firmware asks you, the owner, to approve it personally. That approval is the enrolment step.
You do this once per PC, not once per USB session. The official ventoy.net Secure Boot page documents the same flow with screenshots if your screen differs slightly.
Enrolling Ventoy's key lets the menu run. Most mainstream ISOs then boot fine, but not all: some WinPE builds and older rescue images are unsigned, or signed in ways the firmware rejects, and they stop with the same violation message.
This is the honest expectation to set: a rescue toolkit is only finished when every image on it has been test-booted on a Secure Boot machine like the ones you will actually meet. Discover your stubborn image at home, replace it with a signed alternative, and the emergency call stays boring.
For a genuinely stubborn image on your own PC, the practical route is to enter the UEFI setup, disable Secure Boot temporarily, do the rescue job, and turn it back on immediately afterwards. Treat it like switching off a house alarm while you move furniture - normal, brief, and reversed.
One warning that saves panic: changing boot settings can make a BitLocker-protected Windows ask for its recovery key at the next start, because the boot chain it measured has changed. That is BitLocker being careful, not broken. Have the key findable before you start, and the moment costs nothing.
On company-managed laptops, USB booting, key enrolment and the Secure Boot setting itself are often locked by IT policy. That is not a fault to defeat - it is the organisation's security working as designed, and boot media from outside is exactly what it exists to stop.
If a managed PC needs rescue, the correct tool is the IT department's own process. A technician who respects that boundary on office machines is a technician offices keep calling back.
Watch the full video to see the Ventoy toolkit booted on a real machine, menu to rescue tool, exactly as it happens on a repair job.
▶️ Watch Full VideoIt is Ventoy's documented, intended route, and it trusts one specific key for boot software you chose to download from the official site. The discipline is the same as installing any system tool: official source only, and enrol nothing a stranger hands you.
No. BitLocker noticed the boot configuration changed and wants proof you are the owner. Enter the 48-digit recovery key - often saved in your Microsoft account - and Windows starts normally. Re-enabling Secure Boot restores the original state.
Your old PC most likely has Secure Boot off or is using legacy boot mode, so nothing checks signatures. The new PC checks - and images differ in how they are signed. Same stick, stricter doorman.