Technical Anshu
Tutorials Blog
🔐 Secure Boot Error Fix

Ventoy Shows Verification Failed (0x1A) Security Violation - What Now

You boot your toolkit USB and instead of the Ventoy menu, a blue screen blocks you: "Verification failed: (0x1A) Security Violation". Your USB is fine. The PC's Secure Boot simply does not trust Ventoy's bootloader yet — and you only have to introduce them once.

✍️ Technical Anshu🪟 UEFI / Secure Boot PCs⏱️ 2 minute fix
🎥 Watch the video for the full toolkit setup, including Secure Boot handling on screen

This error appears on the first boot of a Ventoy drive on a PC with Secure Boot enabled. Secure Boot only loads bootloaders signed with a key the firmware trusts, and Ventoy's key is not in that list by default. The fix is called key enrollment: you add Ventoy's key to the PC's Machine Owner Key (MOK) database using a small manager that Ventoy itself provides on that blue screen. It takes about two minutes, it is done once per PC, and afterwards the same Ventoy drive boots normally on that machine with Secure Boot still on.

ERROR SCREEN — FIRST BOOT ON A SECURE BOOT PC
Verification failed
(0x1A) Security Violation
OK
📷 What this error looks like — a blue screen that appears before the Ventoy menu ever opens
1

First, Understand What You Are Seeing

Nothing is broken and nothing is infected. The blue screen is the shim UEFI key management tool doing its job — it caught an unsigned-by-default bootloader and is asking you, the machine's owner, whether to trust it. Because the drive is yours and you built it, the answer is yes — through enrollment, not by weakening the PC's security permanently.

  1. Stay on the blue "Verification failed" screen — do not power off
  2. Press Enter (or select OK) to move to the key management screen
2

Enroll the Ventoy Key in MokManager ⭐

This is the proper fix, and the one shown in the video. Follow the screens exactly:

MENU — SHIM UEFI KEY MANAGEMENT
Shim UEFI key management
Continue boot
Enroll key from disk
Enroll hash from disk
Reboot
Select the highlighted option, then pick the VTOYEFI volume and the ENROLL_THIS_KEY_IN_MOKMANAGER.cer file.
📷 The key management menu — "Enroll key from disk" is the option that fixes the error
  1. On the Shim UEFI key management screen, press any key before the countdown finishes
  2. Select Enroll key from disk and press Enter
  3. Select the VTOYEFI volume from the list and press Enter
  4. Select the file ENROLL_THIS_KEY_IN_MOKMANAGER.cer and press Enter
  5. Choose Continue, then Yes to confirm the enrollment
  6. Choose Reboot — boot the USB again and the Ventoy menu will now open with Secure Boot enabled

That is all. The key stays stored in the PC's firmware, so every future boot of any Ventoy drive on this PC skips the error.

3

If Key Enrollment Fails, Enroll the Hash Instead

On some firmware versions the key enrollment does not stick. The same manager offers a second route:

  1. Return to the key management screen and choose Enroll hash from disk
  2. Browse the VTOYEFI volume into the EFI\BOOT folder
  3. Select the bootloader file grubx64.efi, confirm with Continue and Yes, then reboot

Note honestly: a small number of PCs whose firmware blacklist (DBX) was updated through Windows Update may still refuse Ventoy's bootloader even after enrollment. On those machines, use Fix 4 — it is a firmware decision, not something a different USB can fix.

4

Fallback: Turn Secure Boot Off Temporarily

If enrollment is blocked or you are in a hurry at a work site, disabling Secure Boot always works.

  1. Restart the PC and enter BIOS/UEFI setup (usually F2, Del or F10)
  2. Find Secure Boot under the Security or Boot tab and set it to Disabled
  3. Save and exit (F10), then boot the USB and finish your repair work
  4. When the job is done, you can turn Secure Boot back on — just remember the Ventoy drive will ask for enrollment again on that PC if the key was never enrolled
5

Prevent It on New Drives: Enable Secure Boot Support in Ventoy

When you install or reinstall Ventoy, open Option in Ventoy2Disk and tick Secure Boot Support before clicking Install. This places the shim and the enrollment file on the drive correctly, so the first boot on any Secure Boot PC goes straight to the enrollment flow above instead of a dead end.

🔑 BitLocker users, one caution: changing Secure Boot settings can make Windows ask for the BitLocker recovery key at next start. Before you toggle Secure Boot on a BitLocker-encrypted PC, make sure the owner has that 48-digit key available — otherwise fix 2 (enrollment, no settings change) is the safer route.

🎥 See the Whole Toolkit Setup in Video

Building the Ventoy drive with MediCat, Strelec and Gandalf — plus Secure Boot handling — is shown completely in the video.

▶️ Watch Full Video
❓ Frequently Asked Questions

Is enrolling the Ventoy key safe for my PC?

Yes, when the drive is one you built yourself from the official Ventoy download. Enrollment simply tells the firmware "trust this bootloader". It does not change Windows or your files, and it can be undone from the BIOS by resetting Secure Boot keys to factory defaults.

Will this error appear on every PC I use the drive on?

Only the first time on each Secure Boot PC. Enrollment is stored in that PC's firmware, not on the USB, so the same drive boots straight to the menu on machines where you have already enrolled the key.

Enrollment worked before, but the error came back after a Windows update. Why?

Firmware and Secure Boot blacklist (DBX) updates delivered through Windows Update can revoke older bootloaders. Update Ventoy on your drive using the Update button in Ventoy2Disk, and if the PC still refuses, use the Secure Boot disable fallback for that machine.

This guide is based on Technical Anshu's "One USB = All Tools" video • Stuck on a step? Ask in the video comments — you'll get help there 🙏