Vanguard spent two years as the most complained-about thing Riot ever shipped, mostly because it ran from the moment your PC booted. In June 2026 that finally changed. Here's what it is, what it needs, and how to stop it running all the time.
League of Legends Guide
Vanguard Explained
Anti-Cheat & On-Demand ModeVanguard arrived in League with Patch 14.9 on 1 May 2024, and the reaction was immediate. Not because players objected to anti-cheat, but because of how it worked: a kernel-level driver that loaded when Windows started, whether or not you intended to play, and demanded BIOS settings a lot of people had never touched.
In June 2026 Riot finally shipped the thing everyone had been asking for. Here's the full picture.
What Vanguard Actually Is
Vanguard is Riot's anti-cheat system, and the part that makes it controversial is that it runs at the kernel level. Most software on your computer runs in what's called user space, with limited access. A kernel driver runs at the deepest privilege level the operating system has.
The reason for that design is straightforward: the cheats it's built to catch also operate at that level. Anti-cheat running in user space simply can't see a cheat running below it. If you want to detect kernel-level cheats, you have to be in the kernel too.
It launched in Valorant back in 2020 and came to League in 2024. It also covers Teamfight Tactics, Wild Rift and 2XKO.
What Your PC Needs
To play League at all
- TPM 2.0 enabled
- UEFI boot mode rather than legacy BIOS
- Secure Boot, which is mandatory on Windows 11 and optional on Windows 10
- IOMMU support
Most of these exist in the BIOS rather than in Windows, which is the root of the frustration. Riot can't turn them on for you, and a lot of players who had never opened their BIOS in their lives suddenly needed to.
On-Demand Mode, the 2026 Change
On 24 June 2026, Riot shipped On-Demand mode, which ends the always-on requirement. Vanguard loads when you launch a Riot game and unloads when you close it. It's opt-in, and it needs a stricter security setup than the baseline.
To qualify for On-Demand
- Windows 11 25H2 as a minimum
- Secure Boot
- TPM 2.0
- VBS, virtualisation-based security
- HVCI, memory integrity
- IOMMU
You'll be checked against those automatically by a Pre-Check when you try to enable it. According to Riot's anti-cheat lead Phillip Koskinas, around 35% of players already meet the bar and can switch on straight away. Most of the rest can qualify by changing BIOS settings, and a small minority would need new hardware.
Why this took two years. The always-on design wasn't stubbornness. If the anti-cheat isn't running, a cheat can load its driver before the game starts and be invisible by the time anyone looks. Riot's fix was Runtime Driver Attestation, built with Microsoft's Xbox OS Security team, which lets the game verify at launch that nothing untoward loaded while Vanguard was asleep. That's the technology that made On-Demand possible, and it's why it demands a Windows version new enough to support the attestation.
The Complaints, Fairly Stated
Always-on kernel access
The biggest one, and the one On-Demand answers. Running a ring-0 driver from boot on a machine you also use for work and banking is a real thing to be uncomfortable about, whoever wrote it.
Privacy
Riot's position is that data collection is minimal and that Tencent has no access to Vanguard. Whether that reassures you is a judgement call, but the claim has been made explicitly rather than dodged.
Linux players are locked out
Entirely, and permanently as things stand. Boot integrity can't be attested the way Vanguard needs, so League is simply not playable on Linux anymore. This is the complaint with no answer.
Rollout chaos
Boot loops, crashes and BIOS problems were widespread in 2024. Riot said at the time it hadn't confirmed any case of Vanguard bricking hardware, while acknowledging that some BIOS configurations caused real problems.
The Error You'll Actually Hit
VAN9001 is the common one, and it means TPM 2.0 isn't enabled. It's a BIOS setting, not a Windows setting, so no amount of reinstalling the game will fix it. Depending on your motherboard the option is called TPM, PTT on Intel boards, or fTPM on AMD ones.
Secure Boot problems produce a similar wall. Both are one-time fixes: change the setting, reboot, and you won't think about it again.
Worth knowing before you dig into your BIOS: enabling Secure Boot on a machine that was installed in legacy BIOS mode can stop Windows booting, because the disk needs to be using the newer partition scheme. Check which mode you're in first rather than flipping the setting and hoping. If you're on Windows 11 already, you're almost certainly fine.
Frequently Asked Questions
What's Riot Vanguard?
Riot's anti-cheat system, running as a kernel-level driver so it can detect cheats that operate at the same privilege level. It launched in Valorant in 2020 and came to League of Legends with Patch 14.9 on 1 May 2024.
Does Vanguard still have to run at startup?
Not since 24 June 2026. Riot's On-Demand mode loads Vanguard only when you launch a Riot game and unloads it when you quit. It's opt-in and requires a stricter security configuration than the standard requirements.
What do I need for Vanguard On-Demand mode?
Windows 11 25H2 as a minimum, plus Secure Boot, TPM 2.0, VBS, HVCI and IOMMU all enabled. A Pre-Check verifies this automatically. Riot said roughly 35% of players already qualified at launch, with most of the rest able to by changing BIOS settings.
How do I fix Vanguard error VAN9001?
Enable TPM 2.0 in your BIOS. It's a firmware setting rather than a Windows one, so reinstalling the game won't help. Look for TPM, or PTT on Intel motherboards, or fTPM on AMD ones.
Can you play League of Legends on Linux?
No. Vanguard requires boot integrity guarantees that Linux can't provide in the way it needs, so League has been unplayable on Linux since Vanguard rolled out, and there's no workaround.
Why does Vanguard need kernel access at all?
Because the cheats it targets have it. Anti-cheat running in normal user space can't see a cheat operating at a deeper privilege level, so detecting kernel-level cheats requires being in the kernel too. That's the whole trade-off being argued about.
Have you switched On-Demand on yet, or did the Pre-Check turn you away? Let us know in the comments.
No comments:
Post a Comment
Feel free to comment or leave a message :)