Creating a Windows 11 installation USB on Linux was always a bit annoying. The Windows ISO contains files larger than 4 GB, so a simple FAT32 formatted USB stick does not work. Ventoy makes this much easier and gives me one reusable USB stick for Windows, Linux ISOs and recovery tools.
I use this mostly on my Arch laptop and in my homelab when I need to install Windows on a new PC or a Windows VM. It also works fine for physical machines with UEFI and Secure Boot enabled, without needing an existing Windows machine.
What Ventoy does differently
Ventoy installs a small bootloader to the USB stick and creates a large data partition. Instead of writing one ISO image directly to the stick, I just copy ISO files to this partition.
When booting from the USB stick, Ventoy shows a menu with all ISO files found on it. I can keep a current Windows 11 ISO there, but also Arch, Gentoo installation media, Memtest86 or rescue images.
The USB stick will be erased during the installation, so make sure you selected the correct device.
Do not use a partition such as
/dev/sdb1for Ventoy. You need the whole disk, for example/dev/sdb.
For Secure Boot, Ventoy can use its own signed boot files and asks to enroll its certificate on first boot. This is different from signing your own bootloader with sbctl, which I use on some of my Arch machines. I wrote about my local setup in Arch Linux Secure Boot with systemd-boot, sbctl and a Unified Kernel Image.
Downloading Ventoy on Linux
Ventoy provides release archives for Linux. I download the current ventoy-x.y.z-linux.tar.gz release from the official Ventoy project page and unpack it.
$ cd ~/Downloads
$ tar xvf ventoy-*-linux.tar.gz
$ cd ventoy-*-linux
$ ls
Ventoy2Disk.sh VentoyGUI.x86_64 boot plugin tool ventoyThe command line tool is enough for me. There is also a graphical tool called VentoyGUI.x86_64, but I normally prefer the terminal for tasks which overwrite disks.
First I plug in the USB stick and check its device name.
$ lsblk -o NAME,SIZE,MODEL,TRAN
NAME SIZE MODEL TRAN
nvme0n1 953.9G Samsung SSD
├─nvme0n1p1 1G
├─nvme0n1p2 32G
└─nvme0n1p3 920G
sdb 57.3G USB Flash Disk usb
└─sdb1 57.3GIn this example, the USB stick is /dev/sdb. Check this carefully. Accidentally selecting my system NVMe disk would be a very bad day.
Installing Ventoy with Secure Boot support
Ventoy can create either an MBR or GPT partition table. For current UEFI systems I use GPT. It also works on most older BIOS systems, but my focus here is Windows 11 hardware with UEFI.
The -s option enables Secure Boot support during installation.
$ sudo sh Ventoy2Disk.sh -i -s -g /dev/sdbVentoy will show a warning before it writes anything.
Disk : /dev/sdb
Model: USB Flash Disk
Size : 57 GB
Attention:
You will install Ventoy to /dev/sdb.
All the data on the disk /dev/sdb will be lost!!!
Continue? (y/n) yAfter confirming, the stick contains a small EFI partition and a larger exFAT partition named Ventoy. The exFAT partition is where I copy my ISO files.
$ lsblk -f /dev/sdb
NAME FSTYPE LABEL UUID MOUNTPOINTS
sdb
├─sdb1 vfat VTOYEFI 1234-ABCD
└─sdb2 exfat Ventoy 1234-5678 /run/media/yves/VentoyThe
-soption matters. A Ventoy stick without Secure Boot support can still boot on systems where Secure Boot is disabled, but it will not boot on many company laptops and newer consumer PCs with Secure Boot enforced.
If I already have a Ventoy stick, I can update it later without deleting the ISO files.
$ sudo sh Ventoy2Disk.sh -u -s /dev/sdbI still make sure important ISOs are backed up before updating. A USB stick is not a backup medium.
Copying the Windows 11 ISO
Next I download a current Windows 11 ISO from Microsoft. I use the official download page in a browser and select the multi-edition Windows 11 ISO. The download is several GB, so this can take a while.
After the ISO is downloaded, I simply copy it to the Ventoy partition.
$ cp ~/Downloads/Win11_*.iso /run/media/yves/Ventoy/
$ syncThere is no special extraction step, no dd, and no NTFS formatting required. Ventoy handles the ISO when booting.
I usually keep ISO files in folders to make the menu less messy.
$ mkdir -p /run/media/yves/Ventoy/iso/windows
$ cp ~/Downloads/Win11_*.iso /run/media/yves/Ventoy/iso/windows/
$ syncVentoy scans subdirectories, so the Windows installer will still show up in its boot menu.
First boot with Secure Boot enabled
On the target PC, I boot from the USB device via the UEFI boot menu. The exact key depends on the vendor, but it is often F12, F9, Esc or Enter.
With Secure Boot enabled, Ventoy normally displays its key enrollment screen on the first boot. I select the option to enroll the key, select the VTOYEFI certificate if asked, and confirm the enrollment.
After that, the firmware accepts Ventoy's signed EFI files and the normal Ventoy ISO menu appears. I select the Windows 11 ISO and start the installer.
The key enrollment is only needed once per PC. It does not disable Secure Boot. It adds the Ventoy key to the machine's trusted MOK key list, which allows Ventoy to load while Secure Boot remains active.
Some company-managed laptops block custom Secure Boot key enrollment in firmware. In that case Ventoy cannot bypass the company policy. You need the IT-approved installation media or an administrator changing the policy.
Windows 11 requirements and small caveats
Ventoy can boot the Windows 11 installer, but it does not remove Windows 11 hardware requirements. The target machine still needs supported UEFI boot, TPM 2.0 and normally Secure Boot enabled.
For KVM/QEMU Windows guests, I enable OVMF UEFI firmware and add a virtual TPM device. On my ThreadRipper virtualization machines this is also needed when I create current Windows 11 guests with GPU pass-through. The general GPU setup is similar to my KVM GPU pass-through with identical graphic cards setup.
One pitfall is that some UEFI firmware has a bad or incomplete USB boot implementation. If Ventoy does not show up, I try another USB port first, especially a USB 2 port if available. I also check whether the firmware is configured for UEFI boot only and whether external USB boot is enabled.
After copying an updated ISO, I unmount the stick cleanly before removing it.
$ udisksctl unmount -b /dev/sdb2
$ udisksctl power-off -b /dev/sdbI keep this Ventoy stick in my drawer with current Windows 11, Arch and recovery ISOs. It is much less work than recreating a dedicated USB installer every time. If you know a better Linux-only way for Windows installation media, let me know.