Fix Ventoy UEFI Security Violation Error in Windows 11
Question details
The user needs to resolve a security verification failure that prevents a Ventoy USB drive containing a Windows 11 ISO from booting successfully.
- Product
- Ventoy / Windows 11
- Device & OS
- Windows 11
- Scenario
- Booting a computer using a Ventoy USB drive to install or run Windows 11.
- Observed behavior
- The system halts during boot with a "Verification Failed: (0x1A) Security Violation" error message and redirects the user to the Shim UEFI key management screen.
Ensure your Ventoy USB drive is updated to the latest version, and verify if your computer's motherboard requires Secure Boot to remain enabled for Windows 11 compliance.
Enroll the Ventoy Secure Boot Key (MOK)
This method allows you to keep Secure Boot enabled in your BIOS while securely trusting the Ventoy bootloader.
Since Ventoy uses a custom bootloader, it is not natively recognized by the default UEFI Secure Boot keys on most motherboards. Enrolling the Machine Owner Key (MOK) provided by Ventoy registers it as a trusted source.
Boot from the Ventoy USB drive. When the "Verification failed: (0x1A) Security Violation" error appears, press OK or Enter to proceed to the blue MokManager screen.
On the Shim UEFI key management screen, use your keyboard arrows to select "Enroll key from disk" and press Enter.
Navigate to your Ventoy USB drive partition (typically labeled VTOYEFI). Scroll down and select the file named "ENROLL_THIS_KEY_IN_MOKMANAGER.cer".
Choose "Continue", then confirm the enrollment by selecting "Yes". Once the key is enrolled, select the option to reboot your computer. The Ventoy USB drive will now boot normally without triggering the security violation.
Temporarily Disable Secure Boot in BIOS
If you cannot enroll the MOK key, disabling Secure Boot in your motherboard's UEFI firmware will bypass the verification check entirely.
Boost Your Productivity on Windows 11 with WPS Office
While resolving system boot and Windows 11 installation issues, ensure your document productivity remains uninterrupted. WPS Office is a highly compatible, free, and lightweight alternative to Microsoft Office that runs seamlessly on your Windows setup.
- 1. Visit the official website: Go to the official WPS Office website on your newly configured Windows 11 PC.
- 2. Download the software: Click the Free Download button to get the latest Windows installer.
- 3. Install and launch: Run the installer, follow the on-screen prompts, and instantly open your existing Office documents.
Frequently Asked Questions
Why do I get a security violation when booting Ventoy?
This error occurs because the Ventoy custom bootloader is not recognized by your motherboard's factory-default UEFI Secure Boot keys. Enrolling Ventoy's certificate adds it to the hardware's trusted list, allowing the boot sequence to proceed.
Will disabling Secure Boot affect my Windows 11 installation?
Windows 11 requires Secure Boot capability for initial installation and for specific features like anti-cheat in certain games. While Windows 11 can usually boot with it disabled, it is recommended to keep Secure Boot enabled and enroll the Ventoy MOK key instead.
Can I update my Ventoy USB drive without losing the stored ISO files?
Yes. When you run the Ventoy installer application on your PC, select the 'Update' option rather than 'Install'. This safely updates the bootloader partition on the USB drive without deleting the ISO files stored on the main storage partition.
