Hi,
first, those are not bluescreens, and your config is not at fault. All three photos are firmware screens from before Windows starts.
Verification failed: (0x1A) Security Violation, then Shim UEFI key management, then Perform MOK management. That is Ventoy's Secure Boot chain. 0x1A is EFI_SECURITY_VIOLATION.
Shim itself loaded fine, then refused to verify the next stage and handed you to key management. Windows setup is never reached, which is why your older ISO fails the same way:
the break is in the USB loader, before any image content matters.
Ventoy needs a Machine Owner Key enrolled in your motherboard's NVRAM, once per machine. If Secure Boot was off before your experiment, shim was never enforcing and everything
booted. Turning Secure Boot on is enough on its own to produce these three screens for any ISO on that stick. Clearing or updating firmware also drops an existing enrollment.
Ways out, pick one:
1. Turn Secure Boot off in the BIOS, install, turn it back on afterwards.
2. Enroll the key, which is a one time step and you are already on the right screen. Press a key at "Shim UEFI key management", choose "Enroll key from disk", select the VTOYEFI
partition, pick ENROLL_THIS_KEY_IN_MOKMANAGER.cer, Continue, then Yes at "Enroll the key(s)?", then Reboot.
3. Drop the third-party loader: a plain FAT32 stick with the ISO contents copied onto it. Firmware then loads Microsoft-signed bootmgfw.efi directly, with no shim and no MOK.
FAT32 caps files at 4 GB, so in NTLite pick SWM as the image format before applying. The default 4000 MB part size is already FAT32-safe, and Setup reads install.swm plus
install2.swm natively. To prepare the stick with no tools:
Create a Bootable USB Flash Drive, and note that for UEFI you want the FAT32 variant of the format step, format
fs=fat32 quick, not the NTFS one in the main list.
One heads-up for later, since you were after the 2023 migration: if you ever enable "Update boot manager", the resulting media is signed with the Windows UEFI CA 2023. That will
not pass Secure Boot on firmware trusting only the 2011 CA, which is where this machine sits. Leave it off until the 2023 certificate is actually in your firmware.
Two unrelated things in your config: you disabled crash dumps, so leave them on until the install proves stable, otherwise a real crash later leaves nothing to look at. And
ApplicationGuard is enabled while the Hyper-V compatibility protection is off and Hyper-V related drivers are removed, so check that combination is intentional.
Nothing embarrassing here. Secure Boot is simply now enforcing a boot chain that was never set up for it.
