What Riot Vanguard On-Demand Mode Actually Is
Riot Vanguard on-demand mode is an optional way to run Riot’s kernel-level anti-cheat so the driver only loads while a Riot game is running instead of starting at Windows boot and staying active all the time, provided your PC passes a hardware-based security check called Vanguard Pre-Check.
If you have ever stared at your system tray wondering why Vanguard was camping there even when you were only checking email, this update is aimed directly at you. With on-demand mode, the anti-cheat driver launches when you open a Riot title like Valorant or League of Legends and shuts down when you close the game, instead of loading at system start and remaining present throughout your entire Windows session. That means your anti-cheat boot time overhead drops, while in-match protection stays in place because Vanguard still operates in the kernel when it runs.
There is one major prerequisite: your machine has to meet the Windows security requirements wrapped up in Vanguard Pre-Check. If you ignore the feature or your system does not qualify, Vanguard keeps behaving exactly as it does today, always-on and launched at boot.
The Windows Security Requirements Behind Vanguard Pre-Check
Vanguard Pre-Check is Riot’s label for the set of Windows security requirements your PC must meet before you can switch Vanguard into on-demand mode. It is not a new program you download; it is a checklist of platform security features that Windows and your motherboard firmware either already provide or do not. The minimum operating system is Windows 11 25H2 or later, because that is where the Runtime Driver Attestation Report was introduced, which Vanguard uses to see which drivers have loaded since boot even if Vanguard itself was not running yet.
| Requirement | What it does |
|---|---|
| Windows 11 25H2 or later | Provides the Runtime Driver Attestation Report needed for secure on-demand anti-cheat. |
| UEFI mode and Secure Boot | Verifies the Windows bootloader and blocks bootkits at load time. |
| Trusted Platform Module 2.0 (TPM 2.0) | Acts as an on-board cryptoprocessor that stores keys and backs driver attestation. |
| Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) | Isolates secure memory and checks kernel code before it runs. |
| Input-Output Memory Management Unit (IOMMU) | Works as a firewall between PCIe devices and system memory to block direct memory access abuse. |
Most of these settings live in your UEFI firmware menus and cannot be flipped on from inside Vanguard itself. An updated BIOS may be necessary, and labels vary between boards, so the safe path is to read your motherboard documentation before changing anything. Riot notes that about 34 to 35 percent of players already meet every requirement and will see the option to move into on-demand mode once they update, while roughly 3 percent lack the necessary hardware and would need an upgrade to qualify.
Step-by-Step: Turning On Riot Vanguard On-Demand
Enabling Riot Vanguard on-demand is less about toggling a single switch and more about lining up the right system-level pieces so Vanguard can trust what happened before it starts. Once those pieces are in place, Vanguard’s driver no longer launches during boot; it loads when you start a Riot game and closes when you exit. The key is to focus on meeting Pre-Check rather than hunting for a hidden config file.
- Update Windows to at least Windows 11 25H2 so your system supports the Runtime Driver Attestation Report that Vanguard relies on for on-demand mode.
- Update your motherboard BIOS or UEFI firmware to the latest version so options like Secure Boot, TPM 2.0, and IOMMU are present and stable.
- Enter UEFI setup and enable UEFI boot mode and Secure Boot, following your board’s documentation so you do not accidentally lock yourself out of existing installs.
- In the same UEFI menus, enable TPM 2.0, Virtualization-Based Security (often exposed as virtualization or HVCI options), and IOMMU settings so your platform satisfies Vanguard’s Pre-Check list.
- After booting back into Windows, install the latest Riot client update, then use Vanguard’s built-in Vanguard Pre-Check to confirm your system qualifies and switch Vanguard into on-demand mode when the option appears.
The real gotcha is that BIOS and UEFI menus differ between manufacturers, so an option that looks harmless on one board might behave differently on another. Take your time, read official documentation, and avoid flipping every security toggle in one sitting. Remember that none of this is mandatory: if you prefer not to tweak firmware at all, Vanguard will continue to run at boot and maintain the same anti-cheat protection it offers now.
What Changes for Boot Time, Performance, and Cheat Protection
Once Pre-Check is satisfied and on-demand mode is enabled, Vanguard’s driver component no longer launches when Windows starts. Instead, it loads when you open a Riot title and shuts down when you stop playing, closer to how other kernel anti-cheats behave by tying runtime to game sessions rather than the boot sequence. This means the anti-cheat boot time footprint is reduced, freeing your startup from an always-on kernel driver while your system tray stays quieter during non-gaming hours.
At the same time, the level of in-game anti-cheat protection does not change. Vanguard remains a kernel-level anti-cheat; on-demand mode affects when it runs, not the privilege level it operates at when active. The reason Riot could not offer this before came down to the “who loads first” problem, where a vulnerable driver might load a cheat into the kernel before any anti-cheat started. By working with Microsoft’s Xbox OS Security Team on Windows kernel changes like the Runtime Driver Attestation Report, Vanguard can now retrieve a tamper-resistant list of drivers loaded since boot through the system’s TPM.
Riot reports that cheaters appear in around 0.7 percent of ranked matches across Valorant and League of Legends, and kernel-level cheating remains the most common method. In that context, on-demand mode is less about relaxing anti-cheat and more about reducing constant presence while keeping the same focus on how cheats inject code into the kernel. The practical takeaway: you reclaim some peace during everyday PC use without giving those 0.7 percent an easier time.
Is Vanguard On-Demand Worth Enabling?
If Vanguard’s constant presence at boot has been a deal-breaker for you, on-demand mode is the closest thing to a compromise you are likely to see. With Pre-Check satisfied, the anti-cheat driver no longer loads at Windows start, instead spinning up when your Riot game launches and shutting down when you are done. You lose the system-tray icon during normal desktop use while maintaining the same kernel-level protection when you play.
The catch is that getting there may involve firmware updates and UEFI changes, and Riot itself warns against tweaking BIOS settings without first reading your motherboard documentation. At the same time, this is entirely optional; if you do nothing, Vanguard keeps running exactly as it does today. If you are comfortable making system-level changes and your hardware already supports features like Secure Boot, TPM 2.0, and virtualization-based security, enabling Riot Vanguard on-demand is a reasonable way to reclaim some boot-time headroom without sacrificing anti-cheat protection during gameplay.
