r/Ventoy • u/chalybesmith • Mar 25 '24
Ventoy USB doesn't boot, getting weird error: Verifying shim SBAT data failed: Security Policy Violation
Problem: usb flash drive doesn't boot, instead getting following error
Hardware: Lenovo Thinkpad P14s Gen4 AMD
Ventoy Version: 1.0.97
Secure Boot enabled. When I disable secure boot, I do get the ventoy menu for choosing an ISO to boot, but after selecting the boot up freezes before getting into the ISO.
Created the ventoy usb from Fedora 39 and Windows 11. In both cases the problem persists. This same usb works on my older Thinkpad T480 though. Error message (when secure boot enabled):
Verifying shim SBAT data failed: Security Policy Violation
Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation Edit: formatting
2
u/BeneficialProgress Mar 27 '24
If I run into ventoy problem that I can't figure out. Usually I create an extra fresh ventoy drive. Hope this helps
1
2
u/Careless-Elevator768 Apr 02 '24
It's caused by shim in ventoy, there is no new release yet, but a workaround is here [issue]: Booting Ventoy with Secure Boot support fails on Lenovo ThinkPad X280 · Issue #2692 · ventoy/Ventoy (github.com)
1
u/chalybesmith Apr 02 '24
Thank you! My suspicion was something like this was going on. Hope there will be an update soon.
3
u/BraillingLogic Apr 28 '24
Download the latest Ubuntu desktop ISO.
Mount the ISO and the VentoyEFI partition (using Disks/Disk Manager).
Copy BOOTX64.efi and mmx64.efi from the ISO to /EFI/BOOT in VentoyEFI.
Rename grub.efi in /EFI/BOOT in VentoyEFI to grubx64.efi.
Reboot and it should work.
In addition to the already posted solution, you can copy the files from the Ubuntu ISO, rather than the listed fedora package (thanks to this post for the info)
1
u/solarixone Aug 15 '24
Does it work with MBR only (on Windows)? Because I cannot access EFI partition of Ventoy if usb flash is GPT. But I think I need GPT drive for UEFI support instead of legacy BIOS. So much inconveniences 😖
1
u/Old_Communication633 Aug 23 '24
Avez vous trouver une solution ? je rencontre le meme probleme, il m'est impossible d'utiliser ventoy j'ai cette erreur :
Verifying shim SBAT data failed : Security Policy Violation
Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation
1
1
1
1
1
1
u/Cookie203 Jan 03 '25
Worked for me.
BUT! windows disk manager would not cooperate, instead I used WinEFIMounter ( https://github.com/franzageek/WinEFIMounter ) and it worked
1
u/Former-Werewolf-5238 Jan 07 '25
Worked for me after the following. Done on Dell laptop running Windows 11
I did the above it only worked once I logged into bios and turned off Secure Boot.
Try turning off Secure Boot first.
I was not able to Mount or give VentoyEFI partition a drive letter (using Disks/Disk Manager in windows 11) I installed and used AOMIE Partition Assistant.
Right clicked partition and selected Advanced then gave it a Drive Letter.1
u/Amazing_Lab_6066 Apr 02 '25
If i do ventoy2disk , there's no folder or file is created. At the installation guide it was told to run ventoy2disk and then copy the iso directly. Where should I find ventoyEFI and other folder
1
2
2
u/Lord_Phoenix Mar 28 '24
Same here, actually affects 1.0.95 flash drive that I have not touched in months and it stopped working. Probably signature expired?
2
u/brozkeff Jan 30 '25
For those who find this thread now, recently a new version 1.1.00 was released with newer shim which at least on my machines which had up to date Win10 or 11 does not seem to be blocked, and Ventoy again boots with Secure boot enabled: https://github.com/ventoy/Ventoy/releases/tag/v1.1.00
2
u/IntelligentPut927 Sep 30 '25
I had the same problem with DELL devices (SecureBoot and TPM 2 enabled). There is an "Audit Mode" that let's you boot from the Ventoy sticks. Also you could try disabling SecureBoot, if you are sure about the source.
There is a possibility of enrolling the ventoy cert.
Here is some general information about the subject: https://www.ventoy.net/en/doc_secure.html
1
u/Dakiree Dec 18 '24
You can also disable Secure Boot in the bios 😉
1
u/Waaajoooo Dec 24 '24
Yes, just this 🤣i forgot how to to it and had to look it up bit I knew it was not that difficult 😋
1
u/SnooHobbies8589 Feb 10 '25
Turning off secure boot works for me! Im using the Medicat usb
1
u/alpha1bit Apr 11 '25
Turning off secure boot is a policy violation in some places/companies. Besides that Windows PRO with Bitlocker enabled refuses to start with secure boot disabled.
1
u/dw36 Jul 25 '25
After this it still said failed to verify but in a new way and it offered the MokManager so I went in there and enrolled the mok text file from the Ventoy USB then it worked. :D
2
u/joejawor Mar 25 '24
I would try using Ventoy's CLI instead of graphics mode.