Riot Games Finally Allows 'On-Demand' Vanguard Anti-Cheat, Ending 24/7 Kernel Tracking

Riot Games has fundamentally changed how its highly controversial Vanguard anti-cheat software operates, rolling out an update that allows the program to run strictly "on demand." Starting today, players of Valorant and League of Legends are no longer required to let the software run continuously from the moment their computer boots up.[1]

The new feature, dubbed "Vanguard Pre-Check," allows the kernel-level driver to remain dormant until the user actively launches a Riot game. Once the game is closed, the anti-cheat software shuts down with it, returning full autonomy to the user's operating system.[1][4]

To utilize the on-demand feature, players must meet specific hardware and software requirements. The system requires Windows 11 and relies heavily on modern motherboard security features, specifically TPM 2.0 (Trusted Platform Module) and Secure Boot. Players must actively opt into these native Windows protections to bypass Vanguard's traditional always-on requirement.[1][2]

By leaning on Microsoft's native pre-boot security, Riot can verify that the operating system hasn't been compromised by rootkits or stealth cheats before the game starts. This eliminates the need for Vanguard's own driver, known as VGK.sys, to stand guard from the moment the PC is powered on.[2]

The shift marks the end of a long and contentious chapter in PC gaming. When Vanguard originally launched alongside the tactical shooter Valorant in 2020, its design mandated an always-on, kernel-mode driver operating at "Ring-0"—the deepest privilege level of a computer's operating system.[4]

This persistent access sparked intense backlash from privacy advocates and PC enthusiasts. Critics were deeply uncomfortable giving a video game company continuous, unfettered access to their hardware, noting that a vulnerability in Vanguard could theoretically compromise the entire machine.[4]

The friction intensified in early 2024 when Riot mandated Vanguard for its flagship MOBA, League of Legends. The rollout forced millions of casual players to either accept the intrusive software or abandon a game they had been playing for over a decade. Players frequently complained about the persistent system tray icon and the fact that Vanguard monitored their systems even when they were playing other games or working.[2]

However, the transition to an on-demand model isn't solely a Riot initiative; it is the direct result of a broader architectural shift spearheaded by Microsoft. Following the catastrophic CrowdStrike outage in the summer of 2024—where a faulty kernel-level security update crashed millions of Windows machines globally—Microsoft accelerated efforts to move third-party security software out of the Windows kernel.[3][4]

Microsoft subsequently developed new Windows capabilities that allow security product developers to validate system integrity from user mode. By providing a secure, native handoff, Microsoft enabled companies like Riot to ensure a machine is cheat-free without needing their own drivers running 24/7.[2][3]

Riot is keeping the always-on version of Vanguard as a fallback. Players on older systems running Windows 10, or those with hardware that lacks TPM 2.0 and Secure Boot capabilities, will still need to run the traditional, persistent version of the anti-cheat software to play.[1][2]

For the millions of players who do meet the criteria, the update is a massive quality-of-life improvement. They no longer have to manually disable Vanguard and reboot their PCs just to run sensitive software, virtualization tools, or other games that occasionally conflicted with Riot's aggressive monitoring.[1][4]

Industry analysts view Riot's implementation of Vanguard Pre-Check as a new benchmark for the gaming sector. It challenges other major anti-cheat providers, such as BattlEye and Easy Anti-Cheat, to adopt less invasive methods that respect user boundaries while maintaining competitive integrity.[4]

As operating systems become more locked down and secure by default, the era of video games requiring deep, persistent kernel access may finally be drawing to a close. Vanguard Pre-Check proves that developers can keep hackers at bay without treating their players' computers as hostile territory.[3][4]