For five years, Vanguard has done one thing that annoyed almost everyone who has ever played Valorant: it starts the second Windows boots, whether you're launching the game or just checking email. That changed on June 24, 2026, when Riot rolled out Vanguard On-Demand mode, an optional setting that lets the anti-cheat driver stay asleep until you actually open Valorant or League of Legends, then shut itself down the moment you quit.
Table of Contents
Quick Answer
Vanguard On-Demand Mode is an optional Riot Vanguard feature that loads the Valorant anti-cheat only when Valorant or League of Legends starts, instead of running at every Windows boot. To use it, your PC must pass Vanguard Pre-Check, which requires Windows 11 25H2, TPM 2.0, Secure Boot, VBS with HVCI (Memory Integrity), and IOMMU all enabled. If you don't meet every requirement, Vanguard simply stays on, exactly as before.
Info!
Riot has confirmed that roughly 35% of players already meet every requirement without doing anything. The remaining players can still qualify; most just need to enable settings that are sitting dormant in their motherboard's UEFI firmware. Only about 3% of the player base is on hardware old enough that it can't support this at all, and for them,
Riot Vanguard keeps running Vanguard always on, the way it always has.
What Vanguard On-Demand Mode Actually Changes
Under the old system, Vanguard's kernel driver (vgk.sys) loaded at system startup and stayed resident in the background regardless of what you were doing on your PC. Riot's reasoning was the "who loads first" problem: if the anti-cheat only woke up when the game did, a malicious driver could theoretically load first, do its damage, and unload before anything caught it.
What made On-Demand mode possible is a new Windows feature called Runtime Driver Attestation, built in collaboration with Microsoft's Xbox security team and shipped exclusively in Windows 11 25H2. It uses your PC's TPM 2.0 chip to keep a tamper-proof record of every driver that has loaded since boot, even during the window when Vanguard itself wasn't running. That means Vanguard can check this record when you launch the game instead of needing to babysit your system the whole time. It's a genuine architectural shift in how the Valorant anti-cheat works, not just a UI toggle, which is why the hardware bar exists in the first place.
If you'd rather not deal with any of this, you don't have to. On-Demand is entirely opt-in. Leaving your settings untouched keeps Vanguard running exactly as it has since 2020.
Why This Is Worth Bothering With for Indian Gamers
A background kernel driver isn't free. On a high-end system with 32GB of RAM and a modern CPU, you'd probably never notice Vanguard idling in the tray. But a large chunk of Valorant's Indian player base is running budget and mid-range hardware, think Ryzen 5 5600 or Core i5-12400F builds with 16GB of RAM, where every bit of background overhead theoretically matters more, and where boot times on older SATA SSDs or HDDs are already a pain point.
There's also the privacy angle that's dogged Vanguard since launch: a kernel-level driver watching your system at all times, even when you're not gaming, has understandably made people uneasy. On-Demand mode doesn't reduce what Vanguard can see while it's active, but it does mean it's only active when you're actually playing, which addresses a genuine, long-standing complaint rather than just a cosmetic one.
The Five Requirements, at a Glance
To use On-Demand mode, your system needs to pass all five of the following checks. Miss even one, and Vanguard falls back to always-on mode automatically.
| Requirement | What It Does | How Common on Indian Gaming PCs |
|---|---|---|
| Windows 11, version 25H2 or later | Adds the Runtime Driver Attestation API Vanguard relies on | Needs a manual check; not every PC has auto-updated to it yet |
| UEFI Secure Boot | Verifies the Windows bootloader hasn't been tampered with | Supported on almost every board sold in India since roughly 2015, but often left off during Windows installs done in Legacy/CSM mode |
| TPM 2.0 (discrete or firmware) | Hardware-backed key storage used for driver attestation | Present as fTPM on virtually all Ryzen 3000-series and newer, and Intel 8th-gen and newer CPUs, but frequently disabled by default in BIOS on budget boards |
| VBS + HVCI (Memory Integrity) | Isolates part of the kernel in a hardware-protected memory zone | Requires virtualization enabled in BIOS; some older peripheral drivers can conflict with it |
| IOMMU (AMD-Vi / Intel VT-d) | Blocks direct memory access attacks from PCIe hardware cheats | Available on most modern chipsets, but not always exposed clearly in budget motherboard BIOS menus |
Step 1: Check Where You Already Stand
Before touching anything in your BIOS, see what's already enabled. Riot's redesigned system tray tool does most of this for you now.
- Right-click the Vanguard icon in your Windows system tray (or open the app if it's running) and look for the Pre-Check panel. It lists all five requirements and marks which ones you already satisfy.
- To manually confirm your TPM status, press Win + R, type tpm.msc, and hit Enter. Under "Status," it should say the TPM is ready for use, and the Specification Version should read 2.0.
- To check Secure Boot, press Win + R, type msinfo32, and hit Enter. Look at "Secure Boot State" (should say On) and "BIOS Mode" (should say UEFI, not Legacy).
- To confirm your Windows build, go to Settings > System > About and check the "Version" field under Windows specifications. You need 25H2 or newer.
Info!
If Secure Boot State shows "Unsupported" instead of "Off," that usually means Windows was installed in Legacy BIOS mode rather than UEFI. Converting an existing install from Legacy to UEFI is possible using Microsoft's MBR2GPT tool, but it's not a quick toggle. If this applies to you, weigh whether it's worth the effort against just leaving Vanguard on its default always-on setting.
Step 2: Enable Whatever's Missing in BIOS
Menu names vary by motherboard brand, and Riot's own advice here is worth repeating: don't guess your way through unfamiliar BIOS menus, and check your motherboard manufacturer's documentation if a setting isn't where you expect it. That said, the general path looks similar across most boards sold in India.
- Restart your PC and press Delete, F2, or F10 during the boot splash screen to enter BIOS/UEFI setup (the exact key is usually shown briefly on screen, or check your board's manual).
- On ASUS and MSI boards, look under Advanced > PCH-FW Configuration (Intel) or Advanced > AMD fTPM configuration (AMD) to find and enable TPM.
- On Gigabyte and ASRock boards, this is typically under Settings > Miscellaneous, or Advanced > Trusted Computing.
- For Secure Boot, look under Boot or Security tabs. You may need to set the Secure Boot mode to "Standard" or "Windows UEFI Mode" first, and ensure CSM (Compatibility Support Module) is disabled.
- For IOMMU, look for "SVM Mode" plus "IOMMU" on AMD boards, or "Intel VT-d" under Advanced > CPU Configuration on Intel boards. Both virtualization and IOMMU typically need to be enabled separately.
- Save changes and exit (usually F10), then let Windows boot normally.
- For VBS and HVCI, you don't need BIOS access at all: go to Windows Security > Device Security > Core Isolation and toggle Memory Integrity on. This does require virtualization support (Intel VT-x or AMD-V) to already be enabled in BIOS.
Should You Actually Turn This On?
For most players, yes, but it's worth knowing the trade-offs before you do. VBS and HVCI (the two components that make up what Windows calls Memory Integrity) work by running part of the kernel inside a virtualized, hardware-isolated zone, and that isolation carries a small performance cost. Riot and outside reporting both describe it as a minor, largely CPU-bound overhead rather than something that visibly tanks your frame rate, but on a CPU-limited budget system, "minor" numbers are still numbers.
There's a second wrinkle: VBS automatically activates Microsoft's Vulnerable Driver Blocklist, which can occasionally break older, unsigned drivers for niche peripherals, think an ancient RGB controller or a budget capture card from a manufacturer that stopped issuing updates years ago. If you're running anything like that, test your Valorant anti-cheat settings and On-Demand mode together before assuming it's trouble-free.
Warning!
If you notice a stutter or FPS dip after enabling Memory Integrity, or if a peripheral suddenly stops working, you can safely revert. Turn off Memory Integrity in Windows Security, and Vanguard will simply drop back to its always-on mode. Nothing about this is permanent or risky to your account.
What If Your PC Just Doesn't Qualify
If you're on an older platform, an FX-series AMD chip, a pre-8th-gen Intel CPU, or a motherboard that genuinely lacks TPM 2.0 hardware, there's no workaround here beyond upgrading. That's a real consideration if you're already weighing a budget PC upgrade for something like GTA 6, since most CPUs and motherboards sold in India today support all five Pre-Check requirements out of the box. It's simply not something worth chasing on its own; Vanguard staying in always-on mode has no effect on whether you can play Valorant, rank up, or get matched fairly.
Troubleshooting Vanguard Pre-Check Errors
If VGTray still shows a red mark against a requirement after you've made changes in BIOS, it's almost always one of a handful of predictable causes. Here's how to work through the common ones.
- Secure Boot shows "Unsupported" instead of "Off": This usually means Windows was installed in Legacy/CSM mode rather than native UEFI, so there's no bootloader for Secure Boot to verify in the first place. Check Boot settings in BIOS and confirm CSM (Compatibility Support Module) is disabled. If it was enabled during your original Windows install, you'll likely need Microsoft's MBR2GPT tool to convert your drive from MBR to GPT before Secure Boot becomes available.
- TPM not detected despite having a modern CPU: Almost every Ryzen 3000-series-or-newer and 8th-gen-Intel-or-newer CPU has a firmware TPM (fTPM/PTT) built in; it's just switched off by default on a lot of budget boards. Look for "AMD fTPM" or "Intel PTT" under Advanced or Trusted Computing in BIOS. If it's already on and Windows still doesn't detect it, a BIOS firmware update from your motherboard's support page often resolves it.
- Memory Integrity won't enable in Windows Security: This almost always traces back to virtualization (Intel VT-x or AMD-V/SVM) being off in BIOS. Enable that first, reboot, then try toggling Memory Integrity again. If Windows flags an incompatible driver by name, you'll need to update or remove that specific driver before HVCI will turn on.
- IOMMU option is missing entirely: Some budget motherboard BIOS versions hide IOMMU (AMD-Vi or Intel VT-d) unless SVM or virtualization is already enabled first, since the two settings are often bundled together in the same submenu. Enable virtualization, save, and reboot before hunting for the IOMMU toggle again.
- Vanguard Pre-Check failed after everything looks correctly enabled: Double-check you're actually on Windows 11 25H2 or later, since VGTray will report failure on any earlier build regardless of your hardware settings. Go to Settings > Windows Update and force a check if you haven't updated recently.
- A driver breaks or a peripheral stops working after enabling VBS: This is expected behavior, not a bug. VBS enables Microsoft's Vulnerable Driver Blocklist, which blocks a specific list of known-risky drivers outright. If it's a peripheral you rely on, either wait for an updated driver from the manufacturer or turn Memory Integrity back off; Vanguard will simply revert to running always on.
Does Vanguard On-Demand mode make Valorant run faster?
Not directly. It reduces background load when you're not playing, which can free up a small amount of RAM and reduce boot-time overhead, but it doesn't change in-game performance while Valorant is actually running. If anything, enabling VBS and HVCI as part of the requirements can introduce a small performance cost during gameplay on lower-end CPUs.
Is Vanguard On-Demand mode mandatory?
No. Riot has been explicit that this is fully optional. If you don't enable the required settings, or choose not to switch it on even if you qualify, Vanguard continues running exactly as it always has, at system startup, with no impact on your ability to play.
Will enabling Secure Boot or TPM affect my other games or software?
Generally no, since most modern software is already built to work fine with Secure Boot and TPM 2.0 enabled, and Windows 11 actually requires TPM 2.0 for installation on supported hardware in the first place. The setting most likely to cause friction is VBS and its Memory Integrity component, which can occasionally conflict with older, unsigned third-party drivers.
My motherboard is a few years old. Can it still support this?
Most likely yes, if you're running an AMD Ryzen 3000-series or newer CPU, or an Intel 8th-generation or newer CPU, on a UEFI motherboard. The hardware has typically been capable of all five requirements for years; it's usually just a matter of enabling settings that were left off by default rather than needing new hardware.
Why is Vanguard Pre-Check failing?
Pre-Check failures almost always come down to one of five things: you're not on Windows 11 25H2 yet, Secure Boot is off or unsupported because Windows was installed in Legacy mode, TPM 2.0 is disabled in BIOS, virtualization needs to be enabled before Memory Integrity will turn on, or IOMMU is hidden in a BIOS submenu you haven't checked yet. VGTray will tell you specifically which requirement is unmet.
Does On-Demand mode work for League of Legends too?
Yes. Vanguard On-Demand mode covers both Valorant and League of Legends, since both games run on the same Riot Vanguard anti-cheat. Passing Vanguard Pre-Check once covers your eligibility for both titles; you don't need to configure anything separately per game.
