Create a Ventoy USB and Fix Secure Boot Errors

If you regularly install Linux or Windows, you know the old routine: format a USB stick, write one ISO, install, then wipe the stick and write a different ISO next week. Ventoy ends that waste. One Ventoy USB can hold many ISO files at once, and you simply pick which one to boot from a menu.

The one hurdle many people meet is Secure Boot. The first boot may show a security violation or verification error and refuse to start. This guide shows how to create the Ventoy USB correctly and fix Secure Boot errors the proper way, without permanently weakening your computer security.

Quick Answer

To create a Ventoy USB, install Ventoy to a USB drive using the official Ventoy tool, which formats the drive and creates a large storage partition, then copy your ISO files onto that partition as normal files and boot from the USB to choose one. To fix Secure Boot errors, enrol the Ventoy key when prompted by pressing Enter at the verification screen, using the MOK manager to enrol the key from the Ventoy partition, or temporarily enable the Ventoy Secure Boot support option during installation.

What Ventoy Is and Why It Is Different

Traditional USB tools extract an ISO onto the stick, so one stick equals one installer. Ventoy works differently. It installs a small bootloader onto the drive and leaves the rest as a normal storage partition. You copy ISO files onto it just like documents. At boot, Ventoy lists every ISO it finds and boots the one you select, as if it were a real disc.

One 64GB stick can hold Windows, several Linux distributions, and rescue tools at once. Update an installer by replacing its ISO file, with no reformatting. The Ventoy official website lists supported systems and tested images.

What You Need

• A USB drive, 16GB or larger. 64GB is a practical sweet spot.
• A computer running Windows or Linux to create the stick.
• One or more ISO files downloaded from official sources.
• A backup of anything on the USB drive, because installing Ventoy erases it completely.

Only download ISOs from official sites and compare checksums where provided.

Step-by-Step: Create a Ventoy USB on Windows

1. Back up the USB drive. Everything on it will be deleted in the next steps.
2. Download Ventoy from the official site and extract the zip file.
3. Insert the USB drive and run Ventoy2Disk.exe.
4. Select the correct USB drive from the device list. Double-check the size and label. Choosing the wrong drive erases the wrong data.
5. Before installing, open Option > Secure Boot Support and make sure it is ticked if your target computers use Secure Boot.
6. Also consider Option > Partition Style. GPT is modern and suits UEFI systems. MBR offers wider compatibility with very old machines. For most current PCs, the default is fine.
7. Click Install and confirm the warnings. Ventoy formats the drive and installs its bootloader.
8. When it finishes, the drive appears as a normal large partition, often labelled Ventoy.
9. Copy your ISO files straight onto the drive. Create folders such as Linux and Windows if you like. Ventoy finds ISOs in subfolders too.
10. Safely eject the drive. It is ready to boot.

Creating a Ventoy USB on Linux

On Linux, use the graphical tool in the extracted Ventoy folder. The steps mirror Windows: select the correct device, confirm Secure Boot support, install, then copy ISOs. Run lsblk first and identify the USB by size before confirming any format warning.

Our wider guide to creating a bootable USB drive for Linux installation explains single-image tools too, which is useful background if you ever need a plain installer without a boot menu.

How to Boot From the Ventoy USB

1. Insert the USB into the target computer and restart it.
2. Open the one-time boot menu, usually with F12, F8, Esc, or F11, depending on the brand.
3. Choose the UEFI entry for the USB drive.
4. Ventoy shows its menu listing all your ISO files.
5. Select an ISO and choose Boot in normal mode for a standard install.

If the computer boots into its normal system, enter UEFI setup and confirm USB boot is enabled.

Why Secure Boot Errors Happen

Secure Boot is a UEFI feature that only allows bootloaders signed by trusted keys. It protects against malicious boot software. Ventoy uses a bootloader chain that is not signed by Microsoft by default, so a strict Secure Boot system stops it with messages such as Verification failed, Security Violation, or Access Denied.

This does not mean Ventoy is unsafe or broken. It means your firmware does not yet trust its key. The proper fix is to tell the firmware to trust that key once, using the key enrolment process built for exactly this purpose. The Ventoy Secure Boot documentation describes this flow with screenshots for common firmware screens.

Fix Secure Boot Errors: Enrol the Ventoy Key

Method 1: Enrol From the Blue MOK Screen

On many systems, the first Secure Boot attempt shows a blue screen saying Verification failed and offering to continue or enrol a key.

1. When the blue screen appears, press Enter to continue to the MOK management screen.
2. Choose Enroll key from disk.
3. Select the Ventoy partition, usually shown as the USB device.
4. Open the ENROLL_THIS_KEY_IN_MOKMANAGER.cer file in the Ventoy EFI folder if prompted, or select the key file shown by Ventoy on that screen.
5. Confirm enrolment, choose Continue, and reboot.
6. Boot from the USB again. Ventoy should now start normally under Secure Boot.

Exact wording varies by firmware, but the pattern is consistent: enrol key from disk, pick the USB, pick the key file, confirm. You only do this once per computer. After enrolment, that machine trusts Ventoy on future boots.

Method 2: Enrol the Hash Instead

Some firmware offers Enroll hash from disk instead of key enrolment. If the key method is not offered, choose the hash option, select the Ventoy EFI bootloader file, often grubx64.efi inside the Ventoy partition, and confirm. This trusts that specific bootloader file. If you later update Ventoy and the file changes, you may need to repeat it once.

Method 3: Check Ventoy Was Installed With Secure Boot Support

If no enrolment screen ever appears and boot fails immediately, Ventoy may have been installed without its Secure Boot support files. Plug the stick back into your main computer, open Ventoy2Disk, select the drive, confirm Option > Secure Boot Support is ticked, and use Update to rewrite Ventoy on the stick. Updating preserves the ISO partition, so your copied ISOs stay in place. Then try booting again and enrol the key as above.

Alternative: Temporarily Disable Secure Boot

Disabling Secure Boot in UEFI setup will also let Ventoy boot for a one-off install on your own machine, if you turn it back on afterwards. Key enrolment is the better long-term fix because it keeps protection enabled. Never disable it on a work machine managed by someone else without permission.

Other Common Ventoy Problems and Fixes

The ISO Does Not Appear in the Menu

Confirm the file ends in .iso, was fully copied, and is not inside a zip file. Safely eject after copying so the file is not truncated. Very long folder paths can also hide files, so move the ISO nearer the root and test again.

An ISO Boots to a Black Screen

Try the second boot option Ventoy offers for that image. Also try another USB port and test the ISO in a virtual machine to confirm the download is good.

Common Mistakes to Avoid

• Installing Ventoy to the wrong drive: Always verify size and label. This is the one irreversible mistake in the whole process.
• Forgetting the backup: Ventoy installation formats the stick. There is no undo.
• Skipping Secure Boot support at install time: Tick the option before installing if any target PC uses Secure Boot.
• Giving up at the blue screen: That screen is the fix, not a dead end. Follow its enrol key path instead of powering off.
• Downloading ISOs from random sites: Only use official distribution and vendor pages, and verify checksums when available.
• Pulling the stick out without ejecting: Large ISO copies can be incomplete, causing boot failures that look like Secure Boot faults.

Conclusion

Ventoy turns one USB stick into a complete installer library: install Ventoy once, copy ISOs as normal files, and choose your system from a clean boot menu. Secure Boot errors look alarming, but they have a designed solution. Enrol the Ventoy key once through the MOK screen and that computer will boot Ventoy happily with Secure Boot still protecting it. Keep your ISOs official, your stick backed up, and one enrolment per machine is all it takes.

Frequently Asked Questions

Is it safe to enrol the Ventoy key in Secure Boot?

Yes, when you downloaded Ventoy from its official site. Enrolling a key means your firmware trusts that specific bootloader. It is the standard mechanism Linux distributions themselves use. Only enrol keys for software you obtained from the genuine publisher.

Will updating Ventoy delete my ISO files?

No. Using the Update button in Ventoy2Disk updates the bootloader and keeps the data partition and your ISO files intact. Only a fresh Install formats the drive. Always read the prompt carefully so you pick Update when that is what you want.

Can I store normal files on a Ventoy USB too?

Yes. The large Ventoy partition works like normal storage. You can keep documents, drivers, and portable tools alongside your ISOs. Ventoy simply lists bootable images in its menu and ignores your other files.

Why does one computer boot Ventoy but another shows a security error?

Key enrolment is stored in each computer firmware, not on the stick. A machine where you already enrolled the key boots fine. A new machine needs its own one-time enrolment, or it will stop Ventoy until you complete that step.

Should I choose MBR or GPT when installing Ventoy?

For modern UEFI computers, the default works well and GPT suits newer systems. Choose MBR if you must boot very old legacy BIOS machines. If a target PC is unusually old, test before you rely on the stick for an important job.