Install Linux Mint 22.3 Step by Step (with Screenshots)

You can install Linux Mint 22.3 “Zena” in about a quarter of an hour, but two things happen after the installer finishes that most guides skip. If you tick the multimedia codecs box on a machine with Secure Boot on, the first reboot stops at a blue MOK Manager screen that wants a password you set during setup. And the first update run offers a single package, mint-upgrade-info, before Update Manager shows the rest of the 465 pending package upgrades.

Original content from computingforgeeks.com - post 83646

This step by step guide covers every screen, from writing the USB stick to the first snapshot and firewall. We installed the Linux Mint 22.3 Cinnamon ISO on a UEFI machine with Secure Boot enabled and a blank 32 GB disk, then updated it to kernel 7.0 and Cinnamon 6.6.9, in October 2026. If you’re still choosing, our Ubuntu vs Linux Mint comparison covers how the two differ.

What you need

Mint’s own requirements are modest, 2 GB of RAM (4 GB recommended) and 20 GB of disk (100 GB recommended), but the disk figure is the one to take seriously. Our fresh install used 11 GB, and one Timeshift snapshot plus the first round of updates took it to 21 GB. Have these ready:

• a USB stick of 4 GB or more (the ISO is 2.9 GB)
• a 64-bit PC with 4 GB of RAM, UEFI or legacy BIOS
• 64 GB of disk or more if you will keep Timeshift snapshots on it
• a network connection for the codecs and updates

Any reliable stick will do, since the installer only reads it once. If you need one, our USB flash drive picks favour small, durable sticks; that list was put together for Unraid boot drives, so treat it as a shortlist rather than benchmarks. Linux Mint 22.3 is still the current release, it is supported until April 2029, and the next one, Linux Mint 27 “Adrien” on an Ubuntu 26.04 base, is scheduled for Christmas 2026.

Download and verify the ISO

Pick the Cinnamon edition unless the machine is old or short on RAM, in which case Xfce is the lighter option; all three editions share the same base and updates. Mint also publishes HWE ISOs with a newer kernel for very recent hardware, but its own advice is to use them only when the regular ISO does not work. Download the regular image, its checksum list and the signature from a Mint mirror:

wget https://mirrors.edge.kernel.org/linuxmint/stable/22.3/linuxmint-22.3-cinnamon-64bit.iso \
  https://mirrors.edge.kernel.org/linuxmint/stable/22.3/sha256sum.txt \
  https://mirrors.edge.kernel.org/linuxmint/stable/22.3/sha256sum.txt.gpg

Check the image against the list, then check the list against Mint’s signing key. The checksum proves the bytes arrived intact, and the signature proves the checksum list came from Mint, so you need both:

sha256sum -c --ignore-missing sha256sum.txt
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 27DEB15644C6B3CF3BD7D291300F846BA25BAE09
gpg --verify sha256sum.txt.gpg sha256sum.txt

A good download prints OK for the ISO and Good signature from the Linux Mint ISO Signing Key. The keybox and trustdb lines only appear the first time gpg runs for your user:

linuxmint-22.3-cinnamon-64bit.iso: OK
gpg: directory '/home/josphat/.gnupg' created
gpg: keybox '/home/josphat/.gnupg/pubring.kbx' created
gpg: key 300F846BA25BAE09: 1 duplicate signature removed
gpg: /home/josphat/.gnupg/trustdb.gpg: trustdb created
gpg: key 300F846BA25BAE09: public key "Linux Mint ISO Signing Key <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: Signature made Sun Jan 11 13:29:42 2026 UTC
gpg:                using RSA key 27DEB15644C6B3CF3BD7D291300F846BA25BAE09
gpg: Good signature from "Linux Mint ISO Signing Key <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 27DE B156 44C6 B3CF 3BD7  D291 300F 846B A25B AE09

The “not certified” warning only means you have not signed Mint’s key yourself. What matters is that the fingerprint on the last line matches the key you imported. If the checksum says FAILED, download the ISO again, because a corrupted image usually fails halfway through the install rather than at boot.

Write the ISO to a USB stick

The Mint ISO is a hybrid image, so dd writes it to a stick with nothing else needed. Find the stick with lsblk first and match it by size, because dd erases whatever device you name. Then write it, replacing /dev/sdX with your stick:

sudo dd if=linuxmint-22.3-cinnamon-64bit.iso of=/dev/sdX bs=4M status=progress conv=fsync oflag=direct

When it finishes, lsblk shows the ISO’s label on the stick. Two partitions are normal for a hybrid image, one ISO 9660 and a small EFI one:

NAME    SIZE FSTYPE  LABEL
sdb       4G iso9660 Linux Mint 22.3 Cinnamon 64-bit
├─sdb1  2.9G iso9660 Linux Mint 22.3 Cinnamon 64-bit
└─sdb2    5M vfat

On Windows or macOS, balenaEtcher does the same job, and the bootable USB guide for Linux and macOS covers both tools. If you’d rather keep several installers on one stick, Ventoy boots the ISO file straight from its partition. Whichever tool you use, verify the ISO first, because none of them check it for you.

Boot the live session

Boot from the stick through your firmware’s boot menu (F12, F11 or Esc on most machines). You do not need to turn Secure Boot off, because Mint’s shim is signed and our machine booted the ISO with Secure Boot on. The stick opens a GRUB menu:

Pick Start Linux Mint 22.3 Cinnamon 64-bit. The compatibility mode entry is only for machines whose graphics will not start normally, so try it if the first entry leaves you on a black screen. Our screenshot of the live desktop was taken 90 seconds after pressing Enter, by which time it had fully loaded, and everything you see there runs from the stick:

Use the live session to check Wi-Fi, sound and screen resolution before you commit, because a driver problem is far easier to spot now than after the disk is wiped. Nothing you change here is kept, so it is safe to experiment. When you are ready, double-click Install Linux Mint.

Pick the language and keyboard

The installer opens on its welcome screen. The language you choose here becomes the system language as well, so pick the one you want in menus and error messages, not only for the next few screens:

The keyboard layout follows the language, so English gives you English (US). Use the test box under the lists to type a few symbols such as @ and # before you continue, because a wrong layout is easy to miss until your password stops working at the login screen:

Click Continue once the layout matches the keys on your keyboard. You can add more layouts later under Keyboard in System Settings, so pick the one you type passwords on.

Install the multimedia codecs

Tick Install multimedia codecs. It pulls in mint-meta-codecs, which brought libavcodec-extra and the GStreamer “ugly” plugins on our install, so H.264 video and MP3 play without a separate step. They are not on the ISO by default because of licensing in some countries, and the installer downloads them, so this needs a network connection. If you are installing in a VM without 3D acceleration, Mint’s release notes warn that the gstreamer1.0-vaapi package the codecs bring in can crash Xorg during video playback, and their fix is sudo apt remove gstreamer1.0-vaapi. Our VM never played video, so we did not hit that crash.

With Secure Boot on, ticking the box also reveals a Configure Secure Boot section that asks for a password. Continue stays greyed out until you fill it in, which is how we noticed it:

This password is not your login password. It protects a one-off key enrollment on the first reboot, which lets Secure Boot load third-party driver modules such as NVIDIA’s. Keep it to plain letters and digits, since you’ll type it on a bare firmware screen, and write it down until the first boot is done.

Choose the installation type

On a disk with nothing else on it, Erase disk and install Linux Mint is the right choice. The installer reported no other operating systems on our blank disk, and the write summary later named only the internal disk, never the USB stick:

Advanced features is where LVM and full-disk encryption live. Encryption is greyed out until you tick LVM, so on a laptop tick both. ZFS was removed from the installer in this release, which is why it’s not in the list:

The dialog offers three useful combinations. Pick one now, because switching to LVM or encryption later means reinstalling:

• None: plain ext4, which is what we installed
• LVM: room to resize or add a disk later
• LVM with encryption: a passphrase at every boot, for laptops

Click Install Now, and the installer shows the changes before it writes anything. This is the last point where nothing has been touched:

Two partitions, an EFI system partition and an ext4 root, and no swap partition. That is expected, because Mint uses a swap file instead; ours came out at 3.3 GB on a 4 GB machine. Click Continue only when the disk named is the one you mean to wipe, since the installer starts copying files as soon as you do.

Dual boot with Windows

With Windows already on the disk, the installer offers to install Mint alongside it, and Something else gives you the manual partition editor. Before you touch the partitions, prepare Windows:

1. Back up anything you care about.
2. If BitLocker or device encryption is on, save the recovery key first, because resizing the disk can make Windows ask for it at the next boot.
3. Turn off Fast Startup in the Windows power options, so Windows fully shuts down and releases its partition.
4. Shrink the Windows partition from Disk Management, then install Mint into the free space.

We did not test a dual boot on this run, so treat these steps as the standard preparation rather than lab results, and expect the installer screens on a disk with Windows to differ from the ones above.

Set the time zone and your account

The time zone screen came up set to New York on our machine. Click the map or type a city if yours is wrong:

Then fill in your name, the computer’s name, a username and a password. The computer name is what other machines see on the network, so make it short and specific, like mint01 or office-laptop:

Leave Require my password to log in selected on any laptop or shared machine. Log in automatically is fine for a desktop that never leaves the house, but it also means anyone who powers it on gets your files.

Let the installer finish

The installer had been copying files in the background since you confirmed the disk, so the slideshow that follows is shorter than it looks. By the panel clock in our screenshots, the install, codecs included, finished about 14 minutes after we clicked Install Now:

When it is done, you get the choice between continuing in the live session and restarting. Anything you saved in the live session is lost either way, so copy it off first:

Click Restart Now and take the stick out before the machine boots again. Leaving it in can drop you straight back into the live session, depending on your firmware’s boot order.

Enroll the Secure Boot key on first boot

If you ticked the codecs box with Secure Boot on, the first boot stops at the blue MOK Manager before Mint loads. It doesn’t wait: shim gives you a short countdown, about 10 seconds by default, and then carries on booting without enrolling the key, so be at the keyboard for this boot rather than walking away after Restart Now:

Enroll the key in five steps with the arrow keys and Enter. Each choice opens a new blue screen:

1. Select Enroll MOK.
2. Select Continue on the next screen (View key 0 shows the key first if you want to see it).
3. Select Yes at “Enroll the key(s)?”.
4. Type the Secure Boot password you set in the installer.
5. Select Reboot.

Choosing Continue boot instead skips the enrollment. Mint still starts, but the key exists for third-party kernel modules such as NVIDIA’s, which Secure Boot will not load unless they’re signed by an enrolled key. Once you are logged in, confirm the key is there:

mokutil --sb-state
mokutil --list-enrolled | grep -E "Subject:|CN="

The second key, below Canonical’s, is the one the installer generated for your machine. Its name is generic rather than your hostname, so look for the second Subject line instead of your machine name:

SecureBoot enabled
        Issuer: C=GB, ST=Isle of Man, L=Douglas, O=Canonical Ltd., CN=Canonical Ltd. Master Certificate Authority
        Subject: C=GB, ST=Isle of Man, L=Douglas, O=Canonical Ltd., CN=Canonical Ltd. Master Certificate Authority
        Issuer: CN=localhost.localdomain Secure Boot Module Signature key
        Subject: CN=localhost.localdomain Secure Boot Module Signature key

If you see only the Canonical lines, the enrollment was skipped. Mint itself runs fine without it, but you will want the key before installing a proprietary driver. Queue it again, set a one-time password when asked, then reboot and pick Enroll MOK as above:

sudo mokutil --import /var/lib/shim-signed/mok/MOK.der
sudo systemctl reboot

We did not need this on our install, so it is untested here. The key path is the one Ubuntu’s shim-signed package uses in its update-secureboot-policy script, which Mint 22.3 inherits from its Ubuntu 24.04 base.

Log in and open the first steps

Mint boots to its login screen with your account already listed and the computer name in the top corner. Type the password you set in the installer, not the Secure Boot one:

The Welcome screen opens after the first login. Its First Steps page lists the jobs worth doing on day one, in the order Mint suggests them:

We would do them in a slightly different order, because snapshotting before the updates makes your first restore point a system with 465 pending packages:

1. Apply the pending updates and reboot.
2. Turn on the firewall.
3. Take the first Timeshift snapshot.
4. Check Driver Manager.

The sections below follow that order. Our own run took the Timeshift snapshot before the updates, so the snapshot figures further down describe a pre-update system. Desktop Colors at the top of the list is cosmetic, so leave it for whenever you like.

Apply the pending updates

The 22.3 ISO dates from January 2026, so a fresh install is months behind. Check how far:

sudo apt update
apt list --upgradable 2>/dev/null | grep -c upgradable

Our install had 465 packages waiting, roughly nine months of fixes on top of the January image. The exact count depends on the day you install, and it only grows until Mint publishes a newer image:

465 packages can be upgraded. Run 'apt list --upgradable' to see them.
465

Update Manager does not offer all of them at first. It updates itself before anything else, which is why its command-line tool lists a single package:

mintupdate-cli list

Only the upgrade-path information package is offered. That is Mint’s policy, not a broken cache, so refreshing the list does not change it:

package         mint-upgrade-info                             1.3.0

Install that, and the full list appears: 195 updates on our system, grouped by source package, including the move from kernel 6.14 to the 7.0 HWE kernel. The kernel entries show up on their own with -k:

sudo mintupdate-cli -y upgrade
sudo mintupdate-cli list -k

The kernel group lists the new 7.0 series alongside firmware. The 6.8 entry is the base Ubuntu 24.04 kernel series, and our full upgrade left it uninstalled:

kernel          firmware-sof                                  2023.12.1-1ubuntu1.11
kernel          linux-6.8.0-147.147                           6.8.0-147.147
kernel          linux-7.0.0-38.38~24.04.4                     7.0.0-38.38~24.04.4
kernel          linux-base                                    4.5ubuntu9+24.04.2

Run the same upgrade command a second time to install everything. It took 7 minutes 36 seconds on our machine, then a reboot brought up the new kernel:

sudo mintupdate-cli -y upgrade
sudo systemctl reboot

After the reboot, uname -r reported 7.0.0-38-generic, cinnamon --version reported 6.6.9 and mokutil --sb-state still said Secure Boot was enabled. The graphical Update Manager does the same job from the shield icon in the panel, and its first run opens with a short welcome page:

Click OK, install the Update Manager update it offers first, then refresh and install the rest. Either route ends in the same patched system, so use whichever you prefer. The command-line route is the one we timed above, and it is handier over SSH.

Turn on the firewall

Mint ships UFW and its GUI, Firewall Configuration, but leaves the firewall off. The confusing part is that systemctl calls the ufw service active while ufw itself says inactive, because the service only loads rules when ufw is enabled. If you will ever SSH into this machine, allow port 22 from your LAN before turning the firewall on. Mint does not include openssh-server, so a desktop that never accepts connections can skip that line, and the OpenSSH app profile used below only exists once that package is installed. Without it, use sudo ufw allow from 10.0.1.0/24 to any port 22 proto tcp instead:

sudo ufw allow from 10.0.1.0/24 to any app OpenSSH
sudo ufw enable
sudo ufw status verbose

The default policy blocks every incoming connection except the rule you added. Outgoing traffic is untouched, so browsing and updates keep working:

Replace 10.0.1.0/24 with your own network. The SSH guide for Linux Mint covers installing the server and setting up keys.

Take a Timeshift snapshot

Timeshift is preinstalled and is Mint’s answer to a bad update: it snapshots the system files and leaves your home folder alone by default. The Welcome screen launches its setup wizard, but the first snapshot from the terminal shows exactly what it does:

sudo timeshift --create --comments "fresh install" --tags O

With no config file yet, it picked RSYNC mode and the system disk itself. We trimmed the progress lines, which repeat a few hundred times:

First run mode (config file not found)
Selected default snapshot type: RSYNC
Mounted '/dev/sda2' at '/run/timeshift/2652/backup'
Selected default snapshot device: /dev/sda2
------------------------------------------------------------------------------
Estimating system size...
Creating new snapshot...(RSYNC)
Saving to device: /dev/sda2, mounted at path: /run/timeshift/2652/backup
Syncing files with rsync...
Created control file: /run/timeshift/2652/backup/timeshift/snapshots/2026-10-19_09-12-16/info.json
RSYNC Snapshot saved successfully (135s)
Tagged snapshot '2026-10-19_09-12-16': ondemand
------------------------------------------------------------------------------

That first snapshot, taken before the updates on the 6.14 kernel, took 135 seconds and 7.3 GB, and it lives on the same disk it protects. A snapshot taken after the updates, as we recommend, will be somewhat larger, since it includes the new kernel and packages. It will roll back a broken update, but it will not survive a dead drive, so point Timeshift at a second internal disk or an external drive in its settings if you have one. The Timeshift backup and restore guide covers schedules and restores.

Check Driver Manager

Driver Manager scans the hardware and offers proprietary drivers where they help, mostly for NVIDIA graphics and some Broadcom Wi-Fi chips. It found nothing to offer on our test machine, which has no such hardware:

On a machine with an NVIDIA card, select the recommended driver, apply and reboot; this is where the Secure Boot key you enrolled earns its keep, because the NVIDIA module needs it to load. The NVIDIA driver guide for Linux Mint covers the terminal route and troubleshooting.

Add the apps Mint leaves out

Mint 22.3 ships LibreOffice, Celluloid for video and a Firefox launcher on the panel, but not VLC or GIMP, even though the installer slideshow lists VLC among its featured video apps. Install them from the repositories:

sudo apt install -y vlc gimp

That pulled in 60 packages, 47.6 MB to download and 225 MB on disk, and gave us the VLC 3.0 and GIMP 2.10 series. Flatpak is set up as well, with Flathub already added as a system remote, so the Software Manager offers newer builds of many apps when the Ubuntu-based repository version is too old for you.

Plan disk space before the first snapshot

Mint’s 20 GB minimum gets you through the installer and not much further. This is how root filled up on our 32 GB disk over the first hour, in the order we ran things:

Stage	Used on /	Free
Fresh install (includes the 3.3 GB swap file)	11 GB	19 GB
After the first Timeshift snapshot (taken before updating)	19 GB	12 GB
After the first round of updates, snapshot still on disk	21 GB	8.7 GB

Each later snapshot only stores what changed, but a kernel series update or a big app install can still add gigabytes at a time, as the 2 GB jump from our updates shows. On a single disk we would give Mint 64 GB or more, and on anything smaller we would put the snapshots on a second drive from day one. With that sorted, a same-disk snapshot covers the common failure, a bad update, and an external one covers the rest.