Ventoy Multiboot USB: One Stick for Linux and Windows

Ventoy prepares the stick once; after that you simply copy ISO files onto it, and at boot Ventoy shows a menu of every image. It installs from Linux (Ventoy2Disk.sh) or Windows (Ventoy2Disk.exe); from macOS only through Linux in a virtual machine.

One stick, a dozen systems, no more re-flashing.

What Ventoy is

A boot stick is usually made for a single image: Rufus, balenaEtcher or dd write the whole ISO, and to install another system you have to overwrite the stick. Ventoy works differently. It partitions the stick once: a small partition with the boot loader and a large one (exFAT by default) for your files. You copy ISO images onto the large partition like photos, into any folders. When you boot from the stick, Ventoy finds every image and shows a menu: pick one and its usual installer starts.

Worth knowing up front:

• Ventoy is free and open source. The project lists more than 1,400 tested images: Windows, WinPE, Linux, BSD, VMware ESXi and more. Images larger than 4 GB are supported.
• It boots in both UEFI and legacy BIOS mode, Secure Boot included — more on that below.
• Updating Ventoy itself leaves the images on the stick alone.
• The rest of the space is an ordinary drive: you can carry documents next to the ISOs.

What to put on 32 GB

The rule is simple: the stick carries one current version of each system, and the full archive of older releases lives on a computer or a home server. The stick is a tool, not a warehouse. A sample set that fits on 32 GB (about 26 GB as of October 2026):

Why this set:

• Linux: only the latest release. Older ones are rarely needed, and netinst pulls current packages from the network anyway.
• Windows: by task. Each Windows image weighs 4–7 GB, so only the editions you actually install go on the stick.
• Old systems come with a caveat. Windows 10 support ended on October 14, 2025, and Windows 7 long before. They stay for old hardware and software, not for a computer that goes online every day.

Where to get images and how to check them

Download only from the vendors’ sites and check the SHA-256 checksum: it catches both a broken download and a tampered file.

• Debian — debian.org/distrib: netinst for amd64 and live images. The download folders carry SHA256SUMS and its signature SHA256SUMS.sign.
• Ubuntu — releases.ubuntu.com, with SHA256SUMS and SHA256SUMS.gpg next to the images.
• Windows 11 — Microsoft’s download page, the Windows 11 Disk Image (ISO) section. Checksums for every language are on the same page, in the section about verifying your download.
• Windows 10 — the Windows 10 download page. On Windows it offers the Media Creation Tool, which can also save an ISO.
• Windows 11 Enterprise LTSC — a 90-day evaluation from the Microsoft Evaluation Center, or the full version through volume licensing (part 3).
• Windows 7 is no longer distributed by Microsoft. If you still have an original image, you can check its hash against Microsoft’s file catalogue — for example, with the unofficial dump awuctl/mvs.

On Linux the check is one command (--ignore-missing skips the lines for images you don’t have):

cd ~/iso
sha256sum -c --ignore-missing SHA256SUMS
# debian-13.7.0-amd64-netinst.iso: OK

On a Mac use shasum -a 256 file.iso, on Windows Get-FileHash file.iso in PowerShell, and compare the result with the one on the site. To avoid recomputing it later, store the sum next to the image: sha256sum file.iso > file.iso.sha256. The sync script below uses it.

Microsoft refuses the download: SentinelReject

Sometimes, instead of a link to the ISO, Microsoft’s site says that “some users, entities and locations are banned from using this service” and that anonymous or location-hiding technologies are not allowed. The error code is 715-123130; if you download with a script, the server response contains ErrorSettings.SentinelReject.

The cause is the address you come from. Microsoft rejects requests from data-center and hosting ranges, through VPNs and proxies, and from some regions. It is not a glitch and not an account ban, so repeating the same request won’t help.

What to do:

1. Turn off the VPN or proxy and download in a browser over an ordinary home or mobile connection.
2. On a Windows PC, run the Media Creation Tool and choose “ISO file”: it downloads by a different route.
3. Download on another computer with an ordinary internet connection and carry the file over. What matters is checking the SHA-256 against the table on Microsoft’s page: then it doesn’t matter how the file reached you.

Installing Ventoy on Linux

You need root and the stick plugged into the same computer. Everything on the stick will be erased.

1. Download ventoy-<version>-linux.tar.gz from the GitHub releases page and check it against sha256.txt from the same page.

2. Find the stick. Look at the size, the model and the TRAN column — a stick shows usb there:

   lsblk -o NAME,SIZE,TRAN,MODEL
   

3. Install Ventoy to the whole disk, not a partition: /dev/sdb, not /dev/sdb1.

   tar xzf ventoy-1.1.18-linux.tar.gz
   cd ventoy-1.1.18
   sudo sh Ventoy2Disk.sh -i /dev/sdX     # new stick
   sudo sh Ventoy2Disk.sh -u /dev/sdX     # update Ventoy, images stay
   sudo sh Ventoy2Disk.sh -l /dev/sdX     # what is on the stick now
   

The script asks twice before writing. Useful options: -I reinstalls over an existing Ventoy (also erases everything), -g uses GPT instead of MBR, -r <MiB> leaves space at the end of the disk. Secure Boot support is on by default in Ventoy 1.1 (-S turns it off). If you prefer a window, the archive also has VentoyGUI and the VentoyWeb.sh web UI.

Installing Ventoy on Windows

1. Download ventoy-<version>-windows.zip, unpack it and run Ventoy2Disk.exe.
2. Pick the stick in the Device list. By default only USB drives are listed; Show All Devices is risky — it is easy to pick the system disk.
3. Under Option, check Secure Boot Support and Partition Style (MBR or GPT; it only matters on install).
4. Click Install and confirm twice. For a new Ventoy version use Update: the images stay where they are.

If Ventoy2Disk.exe keeps failing, the project also ships ventoy-<version>-livecd.iso: the computer boots from it and installs Ventoy onto the stick.

What if you have a Mac

Ventoy can’t be installed from macOS: the installers exist only for Windows and Linux (plus the LiveCD), and the project has no macOS version. Your options:

1. Any computer with Linux or Windows nearby — five minutes, and you won’t need it afterwards.
2. Linux in a virtual machine on the Mac with USB passthrough. The stick is handed to the guest system whole, and Linux inside sees an ordinary USB disk. USB passthrough works in UTM (with the QEMU backend, turn on USB sharing in the VM settings; from macOS 27, with Apple Virtualization too), Parallels Desktop, VMware Fusion and VirtualBox. Ventoy2Disk.sh runs on ARM as well: the archive includes aarch64 tools, so a regular ARM Linux on an Apple silicon Mac will do.
3. The Ventoy LiveCD on another computer that has neither Linux nor Windows.

How to tell that passthrough worked. In the guest Linux the stick should appear as a whole disk with usb in the TRAN column:

lsblk -o NAME,SIZE,TRAN,MODEL
# sda   28.9G usb  USB Flash Disk  ← the stick reached the VM

If it’s missing, or you see a disk without usb, there is no passthrough and nowhere to install Ventoy. Ventoy itself does not describe or promise installation from a virtual machine. UTM, for its part, warns that macOS can’t properly reset captured USB devices and some of them misbehave; if it fails, reconnect the stick or try another virtualization app. After installing, check that sudo sh Ventoy2Disk.sh -l /dev/sdX shows the Ventoy version.

From then on the Mac manages on its own. The image partition is exFAT, which macOS reads and writes out of the box. The stick shows up in Finder as “Ventoy”, and images are copied by dragging. Only updating Ventoy itself needs Linux or Windows again. macOS leaves ._name helper files on exFAT; if they show up in the Ventoy menu, remove them before ejecting:

dot_clean -m /Volumes/Ventoy

Two caveats about the Mac itself. The macOS installer doesn’t boot through Ventoy: it needs a separate stick made with createinstallmedia (Apple’s instructions). And an Apple silicon Mac won’t boot from a Ventoy stick at all: it doesn’t run PC boot loaders.

Filling and updating the stick

You can copy images by hand in Explorer, Finder or with cp. Ventoy searches every folder on the partition, so linux/ and windows/ keep things tidy. Always eject the stick properly after copying: exFAT doesn’t like being pulled out mid-write.

With many images that change over time, a script is handier: it copies only what is missing, optionally removes what is no longer in the folder, and checks SHA-256. It writes only to a whole USB disk with a Ventoy partition, and with -n it just shows what it would do.

#!/usr/bin/env bash
# ventoy-sync.sh — copy ISO images from a folder to a Ventoy USB stick.
#   sudo ./ventoy-sync.sh -n ~/iso /dev/sdX          show what would happen
#   sudo ./ventoy-sync.sh ~/iso /dev/sdX             copy what is missing
#   sudo ./ventoy-sync.sh --delete --verify ~/iso /dev/sdX
# --delete removes images that are no longer in the folder,
# --verify checks the sha256 of every image on the stick.
set -euo pipefail

dry=0 del=0 verify=0
while [ $# -gt 2 ]; do
  case $1 in
    -n|--dry-run) dry=1 ;;
    --delete) del=1 ;;
    --verify) verify=1 ;;
    *) echo "unknown option: $1" >&2; exit 2 ;;
  esac
  shift
done
[ $# -eq 2 ] || { echo "usage: $0 [-n] [--delete] [--verify] FOLDER /dev/sdX" >&2; exit 2; }
src=$(cd "$1" && pwd) dev=$2

die() { echo "error: $*" >&2; exit 1; }
run() { if [ "$dry" = 1 ]; then echo "[dry-run] $*"; else "$@"; fi; }
size() { stat -c%s "$1"; }

# Write only to a whole USB disk with a Ventoy partition on it.
[ "$(id -u)" = 0 ] || die "run as root (sudo)"
[ "$(lsblk -dno TYPE "$dev" 2>/dev/null)" = disk ] || die "$dev is not a whole disk"
[ "$(lsblk -dno TRAN "$dev")" = usb ] || die "$dev is not a USB disk"
part=$(lsblk -lnpo NAME,LABEL "$dev" | awk '$2 == "Ventoy" { print $1 }')
[ -n "$part" ] || die "no Ventoy partition on $dev: install Ventoy first"

mnt=$(mktemp -d)
trap 'umount "$mnt" 2>/dev/null; rmdir "$mnt"' EXIT
mount "$part" "$mnt"

cd "$src"
mapfile -t list < <(find . -type f -iname '*.iso' | sed 's|^\./||' | sort)
[ ${#list[@]} -gt 0 ] || die "no .iso files in $src"

# Leftovers of an interrupted copy always go; extra images only with --delete.
while IFS= read -r f; do
  rel=${f#"$mnt"/}
  case $f in
    *.part) echo "remove  $rel"; run rm -f "$f" ;;
    *) [ -f "$rel" ] || [ "$del" = 0 ] || { echo "remove  $rel"; run rm -f "$f"; } ;;
  esac
done < <(find "$mnt" -type f \( -iname '*.iso' -o -name '*.iso.part' \))

need=0
for x in "${list[@]}"; do
  [ -f "$mnt/$x" ] && [ "$(size "$mnt/$x")" = "$(size "$x")" ] || need=$((need + $(size "$x")))
done
free=$(df -B1 --output=avail "$mnt" | tail -n1)
echo "to copy: $((need / 1048576)) MiB, free: $((free / 1048576)) MiB"
[ "$dry" = 1 ] || [ "$need" -le "$free" ] || die "not enough space on the stick"

# A file is written under a temporary name and renamed only when complete.
for x in "${list[@]}"; do
  if [ -f "$mnt/$x" ] && [ "$(size "$mnt/$x")" = "$(size "$x")" ]; then
    echo "ok      $x"; continue
  fi
  echo "copy    $x"
  run mkdir -p "$mnt/$(dirname "$x")"
  run cp "$x" "$mnt/$x.part"
  run mv "$mnt/$x.part" "$mnt/$x"
done
run sync

if [ "$verify" = 1 ] && [ "$dry" = 0 ]; then
  umount "$mnt" && mount "$part" "$mnt"   # read from the stick, not the cache
  bad=0
  for x in "${list[@]}"; do
    if [ -f "$x.sha256" ]; then want=$(cut -d' ' -f1 "$x.sha256")
    else want=$(sha256sum "$x" | cut -d' ' -f1); fi
    got=$(sha256sum "$mnt/$x" | cut -d' ' -f1)
    if [ "$want" = "$got" ]; then echo "OK      $x"; else echo "BAD     $x"; bad=1; fi
  done
  [ "$bad" = 0 ] || die "some images differ: delete them from the stick and run again"
fi
echo "done: the stick is unmounted when the script exits"

How to use it:

chmod +x ventoy-sync.sh
sudo ./ventoy-sync.sh -n ~/iso /dev/sdb                    # look first
sudo ./ventoy-sync.sh --delete --verify ~/iso /dev/sdb     # write and verify

The folder layout is kept: ~/iso/windows/…iso ends up in windows/ on the stick. If there is a .sha256 next to an image, the check takes the sum from it; otherwise it computes the sum of the source file. An interrupted copy never leaves half an image on the stick: a file gets its real name only once it is complete, and the next run removes leftover .part files.

Booting from the stick

1. Plug in the stick and open the boot menu: on most PCs that’s F12, F11, F8 or Esc right after power-on (the key depends on the manufacturer).
2. Pick the stick. If it is listed twice, with and without a UEFI label, take UEFI — it’s the modern mode.
3. In the Ventoy menu, choose an image with the arrow keys and press Enter. The system’s usual installer takes it from there.

Secure Boot. Ventoy can boot with Secure Boot on, but on each computer you confirm its key once, on the first boot. A blue MokManager screen appears: Enroll key from disk → the VTOYEFI partition → ENROLL_THIS_KEY_IN_MOKMANAGER.cer → Continue → Yes → reboot. Since version 1.1.13 Ventoy has a new key (because of the move to UEFI CA 2023 certificates), so after updating from an older version you confirm it again. If you get a different error instead of the blue screen, Secure Boot won’t work with Ventoy on that machine: turn it off in the firmware settings. Some laptops (ThinkPad, Surface and others) also need “Allow Microsoft 3rd Party UEFI CA” enabled in the firmware (details from Ventoy).

UEFI and BIOS. Ventoy boots in both modes; the rest depends on the image. Current Linux and Windows 10 work in either; Windows 11 officially requires UEFI with Secure Boot; old systems need BIOS (on newer boards the mode is called CSM or Legacy and is often disabled).

Windows 7 should be booted in BIOS (CSM) mode. It doesn’t understand Secure Boot, and on machines without CSM its installer won’t start. One more trap: it has no USB 3 or NVMe drivers, so on a new computer it may not see the keyboard or the disk.

macOS can’t be installed through Ventoy — see the Mac section above.

Common problems

• The stick isn’t in the boot menu. Check that USB boot is allowed in the firmware, try another port (USB 2.0 on older machines) and the other mode: UEFI or BIOS.
• “Verification failed”, “Security Violation”. That’s Secure Boot: enroll the Ventoy key as described above, or turn Secure Boot off.
• The image is on the stick but won’t boot or hangs. Check its SHA-256 — a corrupted image is more common than an incompatible one — and see whether it is on the tested list.
• The Windows installer asks for a media driver. Usually it’s a corrupted image or a fussy USB 3 port: check the sum and move the stick to another port.
• The install takes forever. Ventoy reads the image straight from the stick, and a cheap stick reading at 20 MB/s turns an install into a wait. Use a USB 3 stick with decent read speed.
• Windows shows a small VTOYEFI partition. That’s expected: it’s the Ventoy boot loader (32 MB); leave it alone.

Next in the series: your own Debian live image that boots from this stick and lets you straight in over ssh.