Ventoy Secure Boot Verification Failed - Enroll the Key From Disk
You boot the Ventoy USB on a newer PC and instead of the menu you get a blue screen: Verification failed: (15) Access Denied. Nothing is broken - Secure Boot just does not trust Ventoy yet. This guide enrols Ventoy's key into the PC, once, without switching Secure Boot off.
By Technical AnshuVentoy USB Guide8 minute read
Watch the complete guide video for the live Secure Boot screens - the exact menu choices, in the exact order
Modern PCs ship with Secure Boot switched on. Secure Boot only runs bootloaders whose cryptographic key the firmware trusts, and on a PC that has never seen Ventoy, Ventoy's key is not on that list yet. So the firmware stops the boot with Verification failed: (15) Access Denied. Ventoy is fully prepared for this moment - it carries its key file on the USB drive itself. You just have to walk the firmware through trusting it, one time, using a tool called the MOK Manager.
UEFI boot screen - what you see before the fix
Verification failed: (15) Access Denied
Press Enter / OK on this screen - do not power off. The next menu is the fix.
The blue verification screen is not an error in Ventoy - it is the doorway to the MOK Manager key enrolment
1
First Check - Secure Boot Support Was Enabled on the Drive
The enrolment only appears if the drive itself was prepared for Secure Boot. On your Windows PC:
Run Ventoy2Disk.exe, select your drive
Open the Option menu and confirm Secure Boot Support is ticked
If it was not ticked, click Update with it ticked now - your ISO files are not affected by an update
Safely eject the drive and go back to the target PC
2
Boot the USB and Open the MOK Manager
Insert the drive, power on the PC and open its boot menu (commonly F12, F9 or Esc)
Select the UEFI entry for your USB drive
The blue Verification failed: (15) Access Denied screen appears - press Enter / OK
The MOK Manager menu (titled "Perform MOK management") now opens
Perform MOK management - the menu that opens next
Continue boot
Enroll key from diskchoose this one
Enroll hash from disk
Reboot
Inside MOK Manager, the correct choice is Enroll key from disk - you then point it at the key file stored on the USB itself
3
Enrol the Key File From the VTOYEFI Partition
Select Enroll key from disk
In the file browser, open the volume named VTOYEFI (the small 32 MB Ventoy partition)
Select the file ENROLL_THIS_KEY_IN_MOKMANAGER.cer
Choose Continue, then confirm with Yes on the enrolment question
Set a password when asked - any password you can still remember in two minutes; it is only used to confirm this one enrolment
Select Reboot
4
Confirm After Reboot and Boot Ventoy Normally
The PC restarts. If the MOK Manager appears again and asks for the password you just set, type it to confirm the enrolment
Open the boot menu and select the Ventoy USB once more
This time there is no blue screen - the Ventoy menu opens directly, with Secure Boot still enabled in the BIOS
On this PC you never repeat the process - the trust is stored in the firmware now
Honest alternative: switching Secure Boot off in the BIOS also makes Ventoy boot, and many quick guides suggest only that. It works, but it lowers the PC's boot security for everything, forever. Enrolling the key takes the same two minutes and keeps the protection on - that is why this guide recommends it.
If you forget the password you set during enrolment, do not panic and do not keep guessing inside other BIOS menus. The pending enrolment is simply discarded and nothing on the PC changes - just repeat this guide from Step 2 and set a password you remember.
See the MOK Manager Screens in the Video
The blue verification screen confuses everyone the first time. The video walks through every option so you know exactly what to press.
Yes. You are adding Ventoy's public signing key to the firmware's trusted list, the same mechanism Linux distributions use. It does not modify Windows, and it can be undone later from the BIOS Secure Boot settings by resetting the keys to factory defaults.
I disabled Secure Boot before and Ventoy worked. Must I redo everything?
No. If Secure Boot stays off, Ventoy boots without any enrolment. Enrolment only becomes necessary when you turn Secure Boot back on - which is recommended, since other software also relies on that protection.
The MOK Manager never appears - I only see a red Secure Boot Violation box. Why?
That red box comes from the PC's own firmware on some brands, before Ventoy's loader even starts. On those machines, briefly enter the BIOS, confirm Secure Boot Support is enabled on the drive (Step 1), and try again; a few strict business-class firmwares only accept enrolment through their own BIOS key-management screens.
This guide is based on the Ventoy Complete Guide video by Technical Anshu - Update, Secure Boot and File Detection Fix - Stuck on a step? Ask in the video comments, help is always there.