You boot Strelec on a modern laptop and instead of the toolkit you get a blue screen — Verification failed, 0x1A Security Violation. The ISO is fine. Secure Boot simply does not trust it yet. Here is the two-minute enrolment that fixes it permanently for that machine.
Secure Boot only runs boot files signed by keys the machine trusts, and the Strelec boot files are not signed with a Microsoft-trusted key. Booting the ISO through Ventoy produces the famous error because Ventoy's own loader needs its key enrolled once on that PC. That one-time enrolment — done in the blue MokManager screens — is this entire fix. No settings are weakened, and Secure Boot stays on.
If the machine instead boots straight back to Windows, secure the basics first: Ventoy installed correctly on the stick, the UEFI entry selected in the boot menu, and Fast Boot not skipping the stick.
ENROLL_THIS_KEY_IN_MOKMANAGER.cerTake the file from your own Ventoy stick only. A certificate offered by a random website is not a substitute — the whole point of this screen is deciding what the machine will trust.
Reboot, open the boot menu, select the Ventoy stick, and choose the Strelec ISO again. This time there is no violation screen — the machine now trusts the loader, the Strelec boot manager appears, and you pick Boot WinPE 11 Sergei Strelec (x64) as usual.
The enrolment is stored in the machine's firmware, so it is a one-time job per PC — the same stick boots cleanly on that machine forever after. A different PC needs its own two minutes.
The other route is opening the BIOS and disabling Secure Boot, then re-enabling it after the job. It works, but know its costs: some machines demand a supervisor password dance, and changing boot security settings can make a BitLocker-protected Windows demand its 48-digit recovery key at the next start. If you service a customer's machine this way, have them present with their key, or use the MokManager route, which changes no BIOS security setting at all and is the method this guide recommends.
Every step shown live on a real PC — download, USB creation and the full Strelec toolkit tour.
▶️ Watch Full VideoIt adds Ventoy's signing key to the machine's trusted MOK list, which is precisely the mechanism Secure Boot provides for owner-approved loaders. The PC will then trust media signed with that key. Enrol only from your own genuine Ventoy stick, exactly as you would only install drivers from sources you trust.
The old PC likely has Secure Boot off or predates it. New laptops ship with Secure Boot enforced, and Strelec's boot files are not Microsoft-signed, so the firmware blocks them until the Ventoy key is enrolled or Secure Boot is paused.
BitLocker watches boot security settings; changing them can trigger recovery mode by design. Enter the 48-digit recovery key from the owner's Microsoft account or records to start Windows once, after which it normally reseals. This is why the MokManager route — no BIOS change — is preferred on customer machines.