Windows 11 won't boot on a Lenovo Yoga 7i

Question

Windows 11 won't boot on a Lenovo Yoga 7i

jsaeg12 45

Hello, I own a Lenovo Yoga 7i 14IML9 that won't boot Windows. I tried to boot the installation media made with the official Media Creation Tool, and that also won't boot. Rufus gives an error (FAIL: Windows bootmgr encountered a security violation or internal error), and Ventoy reboots after saying "Press any key to boot from CD/DVD..." I also tested Linux Mint, and strangely enough, it boots fine. I already disabled Secure Boot, Device Guard, Intel PTT, and Intel VT-d, and it still won't work.

0 comments

Answer accepted by question author

Thomas4-N 19,240 Microsoft External Staff Moderator

Hello jsaeg12, thanks for the follow up.

At this point, with Secure Boot truly off now (Disabled + User + Standard), the latest BIOS already on the device, a fresh 25H2 ISO on FAT32, and three independent tools all failing the same way while Linux Mint boots fine, pretty much every lever on the Windows/Microsoft side has been pulled. The 1709 stick detail is interesting too.

What that really leaves is firmware-side behavior on your specific unit rejecting the Windows boot manager while still accepting Linux's signed shim. It's not something we can reach, verify, or change from the Microsoft side. There's no Windows setting, no media tweak, no BIOS toggle left that I'd confidently point you to.

At this point the realistic next stop is Lenovo Support for your Yoga 7 2-in-1 14IML9 — they're the ones who can actually look at the firmware-level behavior on the board. Worth sharing the full history so they don't restart from scratch.

jsaeg12 45 Reputation points

2026-06-12T18:17:21.0866667+00:00

Thank you so much Thomas4-N. I will try asking Lenovo next.

2 additional answers

Your answer

jsaeg12 45 Reputation points

2026-06-12T18:17:21.0866667+00:00

Thank you so much Thomas4-N. I will try asking Lenovo next.

Answer 1

Thomas4-N 19,240 Microsoft External Staff Moderator

Hello jsaeg12, thanks for the follow up.

With a current 25H2 ISO and Secure Boot already disabled, the revoked pre-2023 bootloader angle (CVE-2023-24932) doesn't really fit anymore. The thing that stands out now is the Secure Boot state itself. "Disabled" but with Platform Mode: Setup and Secure Boot Mode: Custom isn't a normal clean-off configuration — Setup Mode means the Platform Key has been cleared, and Custom means it's running custom keys rather than the factory set. A genuine "off" is usually just Disabled + Standard. That odd in-between state is a plausible reason Linux Mint sails through (its signed shim satisfies the firmware) while the Windows bootmgr gets rejected at the policy check.

So before anything drastic, I'd try normalizing that state in BIOS:

Set a Supervisor password first — on Lenovo, Secure Boot changes sometimes won't truly stick without one.
In the Secure Boot section, look for Restore Factory Keys (or "Reset to Setup" then re-provision) and apply it.
Set Secure Boot Mode back to Standard, not Custom.
Confirm CSM / Legacy is fully disabled so it's pure UEFI.
While you're at it, check Lenovo's support page for a BIOS/firmware update for the 14IML9 — outdated firmware can throw this same violation on newer boards.

Then retry booting the FAT32 25H2 stick. If it still fails after that, let me know what the BIOS shows for Platform Mode afterward and we'll go from there.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

jsaeg12 45 Reputation points

2026-06-09T23:44:15.58+00:00

I didn't see an option to set a Supervisor password, but I set an Administrator password. When I clicked Restore Factory Keys, the Secure Boot status automatically changed to:

Secure Boot Status: Disabled

Platform Mode: User Mode

Secure Boot Mode: Standard

But I didn't see an option for CSM / Legacy in the BIOS.

My BIOS version is NWCN26WW, which is the same version I saw on the site.
Thomas4-N 19,240 Reputation points Microsoft External Staff Moderator

2026-06-10T10:03:22.23+00:00
Thanks for the update. I just want to make sure I'm reading the situation right — a couple of things to confirm:

After restoring the factory keys, did you actually retry booting the FAT32 Windows 11 25H2 USB? If yes, what happened — same "security violation" from Rufus, the Ventoy reboot loop, or something different now?

Is it still all three Windows tools failing (MCT stick, Rufus stick, Ventoy), or has any of them changed behavior?

The 25H2 ISO you used — was it freshly downloaded from Microsoft recently, or one you'd had sitting around for a while?

Because the BIOS state you had originally (Setup + Custom) wasn't a clean "off," so it's plausible just normalizing it was enough and the stick now boots. But if it's still failing in the same way, that points more toward the install media itself, and we'd go a different direction from there.
jsaeg12 45 Reputation points

2026-06-11T16:05:36.6266667+00:00

I tried all three USB drives (the ones with Media Creation Tool, Ventoy, and Rufus, and all three of them did the exact same things as before.

I downloaded the Windows 11 25H2 ISO shortly after the problem started.

I'm not sure if this helps, but a while back, before this issue started, I remember I booted a Windows To Go USB Drive (made with Rufus) that had Windows 10 1709 on it, and it worked fine. So I'm not 100% sure if the CVE-2023-24932 thing makes sense.

Answer 2

Thomas4-N 19,240 Microsoft External Staff Moderator

Hello jsaeg12,

Thanks for the detail — the fact that Linux Mint boots but every Windows tool throws a "security violation" actually narrows things down a lot. That specific bootmgr error is usually the revoked pre‑2023 Windows bootloader (CVE‑2023‑24932) being rejected, but a couple of things in your post don't quite line up with the textbook case, so I'd rather confirm than guess and send you down the wrong path.

Could you check/share a few things:

Which Windows ISO/build you used — and roughly when you downloaded it. If it's an older cached ISO, that alone can trigger this; the current build shouldn't.
How the USB was formatted — was it FAT32? The Microsoft guidance for this error specifically calls for FAT32 install media.
Secure Boot's actual state in firmware, not just the toggle. On Lenovo, go into BIOS (tap F1/F2 at the Lenovo logo) and confirm Secure Boot reads Disabled, and note whether the mode shows as Standard / Setup / Custom. Sometimes the toggle won't truly take unless a Supervisor password is set first.
Whether there's already a Windows install on the internal drive, or the disk is blank/new.

Once I know the ISO age, the USB format, and that Secure Boot is genuinely off (not just flipped), I can point you to the right fix.

Thomas4-N 19,240 Reputation points Microsoft External Staff Moderator

2026-06-06T16:47:22.45+00:00

Hello jsaeg12,

Just check in to see how things are going. Let me know if you need anything.
jsaeg12 45 Reputation points

2026-06-08T20:13:55.09+00:00

Thank you Thomas4-N.

The Windows build was Windows 11 25H2.

The USB drive was formatted as FAT32.

It says in the BIOS:

Secure Boot Status: Disabled

Platform Mode: Setup Mode

Secure Boot Mode: Custom

I tried to run installation when the computer contained a blank disk, a disk with a Windows 11 installation on it, and a disk with a Linux Mint installation on it. They all don't work.