What Vanguard On-Demand Mode Is and Why You Might Want It
Vanguard on-demand mode is an optional way to run Riot’s kernel-level anti-cheat so that its driver only launches when you open a Riot game and shuts down once you stop playing, instead of loading at Windows boot and staying in your system tray around the clock. If you’ve been annoyed at Riot’s anti-cheat setup feeling intrusive, this is aimed squarely at you. The always-on driver has been the main complaint since Vanguard shipped with Valorant and later expanded to League of Legends, because it lived in the background even when you were working or watching streams instead of gaming. On-demand mode lets you keep the same level of cheat protection while you play, but disable anti-cheat background behavior for the rest of your day. The one catch is that this new flexibility depends on meeting the Vanguard Pre-Check requirements, which tie the feature to modern Windows security hardware and settings.
Vanguard Pre-Check Requirements: What Your PC Needs
Before you can flip Vanguard into on-demand mode, your PC has to pass something Riot calls Vanguard Pre-Check, a bundle of modern Windows security features that must be enabled. The foundation is Windows 11 25H2 or later, partly because that’s where the Runtime Driver Attestation Report first appears and partly because older operating systems are easier for cheat developers to exploit. From there, you need UEFI boot with Secure Boot turned on, Trusted Platform Module 2.0 (TPM) available, virtualization-based security (VBS) with Hypervisor-Protected Code Integrity (HVCI), and an Input-Output Memory Management Unit (IOMMU) active in firmware settings. These form a trust chain so Vanguard can check which drivers have loaded since boot, even if it was not running at the time. Most new machines ship with many of these active already, but older hardware may need BIOS changes or might miss a feature entirely, in which case on-demand mode will not be offered.
| Requirement | What It Does | Where It Lives |
|---|---|---|
| Windows 11 25H2 or later | Provides the Runtime Driver Attestation Report needed for secure driver tracking. | Operating system |
| UEFI Mode and Secure Boot | Verifies the Windows bootloader and blocks bootkits during load. | BIOS/UEFI firmware |
| Trusted Platform Module 2.0 (TPM) | Stores cryptographic keys and backs driver attestation through the system’s TPM. | Motherboard / CPU |
| Virtualization-Based Security (VBS) and HVCI | Isolates secure memory and verifies kernel code before it executes. | Windows security settings |
| Input-Output Memory Management Unit (IOMMU) | Acts as a firewall between PCIe devices and system memory to block direct memory access abuse. | BIOS/UEFI firmware |
Step-by-Step: Turning On Vanguard’s On-Demand Mode
Think of this part as a quick checklist with a friend looking over your shoulder. The important warning up front: don’t rush BIOS changes without your motherboard manual nearby, because every vendor labels these options differently and a wrong toggle can cause boot problems. Riot’s approach is that if you do nothing, Vanguard keeps running exactly as it does now, so you are opting in rather than being forced. Also remember that this does not change Vanguard being kernel-level anti-cheat; it only changes when it runs, not how deep it sits in the system. With that in mind, the sequence to get on-demand mode is straightforward once your hardware and firmware cooperate, and it ends with the driver loading when you start a Riot title and shutting down when you close it, instead of sticking around from boot.
- Make sure Windows Update has moved your system to Windows 11 25H2 or a later build, since older versions do not support the driver attestation report Vanguard relies on.
- Restart your PC and open the BIOS or UEFI setup menu, then confirm that you are booting in UEFI mode with Secure Boot enabled so Windows can validate the bootloader and block bootkits.
- In the same firmware menus, check that TPM 2.0 (sometimes called PTT or fTPM) is present and switched on, because Vanguard uses the TPM-backed Runtime Driver Attestation Report to see which drivers have loaded since boot.
- Still in BIOS or later within Windows settings, enable virtualization-based security and Hypervisor-Protected Code Integrity so the system isolates secure memory and verifies kernel code before execution.
- Find and activate the IOMMU option in your firmware (often listed as Intel VT-d or AMD IOMMU) to create a firewall between PCIe devices and system memory and stop direct memory access abuse.
- Boot back into Windows, install any pending Riot game updates, and then look for the new toggle inside Vanguard’s interface that appears once your system passes Pre-Check, letting you switch the driver into on-demand mode instead of always-on.
What Changes After You Enable On-Demand Mode
Once your PC satisfies Vanguard Pre-Check and you flip the toggle, Vanguard’s driver no longer launches when Windows starts. Instead, it loads when you open Valorant or League of Legends and shuts down when you stop playing, so the familiar system tray icon disappears during your non-gaming time and your taskbar “reclaims” its space until you start a Riot title again. This addresses the long-standing frustration that Riot’s anti-cheat had to run around the clock to be effective, because earlier Windows versions made it harder to see whether a vulnerable driver had slipped a cheat into the kernel before Vanguard loaded. The new Runtime Driver Attestation Report, checked through the TPM, closes that “who loads first” gap by giving Vanguard a secured list of every driver that has loaded since boot, whose record can be extended but not altered without breaking the trust chain.
Is Vanguard On-Demand Worth It and What to Watch For?
If you care about your PC feeling clean when you are not gaming, Vanguard on-demand mode is worth the setup effort. It keeps Riot’s kernel-level anti-cheat tied to the game session instead of your boot sequence, so you disable anti-cheat background behavior during work, school, or content creation while keeping the protection when you queue ranked. Riot reports that cheaters show up in roughly 0.7 percent of PC ranked matches across Valorant and League of Legends, and kernel-level methods are still the most common. Their strategy is to focus on how cheats get code into the kernel rather than chasing every individual cheat, which is the same idea behind the attestation-backed on-demand setup. The main things to watch for are whether your hardware really meets Pre-Check and whether BIOS changes behave as expected. If your PC fails the checks, you are not locked out of the games; you just keep the original always-on Vanguard instead.
