But the story is more nuanced than gaming PCs becoming permanently locked-down consoles. Riot now offers qualifying systems an optional way to run Vanguard on demand. The important architectural shift is toward verifying the Windows environment—and deciding which protections must remain active to trust it.
What changed when League adopted Vanguard?
Riot’s patch 14.9 notes established a clear boundary: players could not queue for or play League until Vanguard was installed and active. Installation also required a restart to activate it. This was an access requirement, not an optional security recommendation.
Vanguard consists of a client that operates during gameplay and a kernel-mode driver. Riot’s current support documentation describes its usual behavior as starting at boot; disabling it normally means restarting before returning to a game that requires it. However, the same documentation explicitly recognizes an on-demand alternative through Vanguard Pre-Check.
That distinction matters. “Requires kernel anti-cheat” and “must always load its driver at startup” are no longer interchangeable descriptions.
Kernel access changes the stakes—not Windows’ architecture
Vanguard did not invent kernel-mode anti-cheat. Riot acknowledged that explicitly in its original explanation of the League rollout. Its stated objective was to establish a trustworthy environment and prevent interference with the game, rather than merely identify individual cheating programs after they appeared.
Microsoft’s documentation also corrects an overly casual description of Windows user space. Applications do not inhabit one communal memory pool: each user-mode process receives a private virtual address space and handle table. Isolation is a fundamental part of the design, not something anti-cheat software added later.
Kernel-mode code occupies a more privileged position. That makes it useful for security enforcement, but it also changes the consequences of defects. Microsoft explains that kernel-mode drivers share the operating system’s address space; a faulty driver can compromise operating-system data and crash the entire machine. An application failure and a kernel failure are therefore very different troubleshooting events.
The trade-off is privilege: deeper enforcement comes with greater responsibility for reliability. That architectural risk is real, but it does not establish how frequently any particular anti-cheat causes crashes.
The important update: Vanguard can run on demand
In its June 24, 2026 announcement, Riot introduced optional on-demand sessions for sufficiently secured PCs. In this mode, Vanguard’s driver starts with a Riot game and remains active only while a Riot title is being played. Players can retain the conventional startup behavior instead.
Riot lists these Pre-Check prerequisites:
- At least Windows 11 version 25H2.
- Secure Boot and TPM 2.0.
- IOMMU protections.
- Virtualization-based security and HVCI.
Riot attributes the change partly to Runtime Driver Attestation: TPM-backed measurements let Vanguard inspect a record of drivers loaded since boot, including when Vanguard was absent. According to Riot, Windows 11 25H2 introduced the required reporting capability.
These are requirements for the optional mode—not a new universal Windows minimum for Vanguard. Riot also explicitly distinguishes ordinary League operation from VALORANT: its announcement says League does not universally require Secure Boot from Windows 11 players, whereas Pre-Check does.
The architectural implication is significant: stronger platform protections can reduce the need for a continuously present third-party driver, rather than simply adding another permanent security layer.
Why a signed driver can still be dangerous
A digital signature is not a lifetime warranty against programming mistakes.
Microsoft documents attackers exploiting vulnerabilities in legitimate, signed kernel drivers to execute malicious code in the kernel. This is the underlying problem behind bring-your-own-vulnerable-driver attacks: trusted provenance does not necessarily mean safe behavior.
Windows has its own response. Microsoft says its vulnerable-driver blocklist has been enabled by default since the Windows 11 2022 Update. Memory Integrity, also called HVCI, is another condition that enforces the list on supported systems. Updates arrive through Windows servicing.
There are limits:
- Microsoft does not guarantee that the blocklist covers every vulnerable driver.
- Blocking a driver can break software or hardware functionality.
- Some blocks are delayed while vendors address compatibility.
- Microsoft recommends testing enterprise driver-blocking policies in audit mode before enforcing them.
The practical lesson is not to disable Windows protections when an old utility stops working. It is to treat driver compatibility and security as connected maintenance problems.
DMA protection is a separate layer
Direct Memory Access is legitimate hardware functionality, not a cheating invention. Microsoft describes the security problem as peripherals accessing system memory without ordinary processor-mediated interactions. Windows Kernel DMA Protection uses the IOMMU to constrain that access.
However, “enable IOMMU and everything is protected” is too sweeping. Microsoft distinguishes devices whose drivers support DMA remapping from those that do not. Compatible peripherals can access assigned memory regions; incompatible peripherals are normally prevented from starting before an authorized user signs in or unlocks the system. Administrative policy can change that behavior.
Kernel DMA Protection also requires UEFI support and does not require virtualization-based security. It is a Windows protection with its own prerequisites—not another name for Vanguard.
For readers checking their machines, Microsoft documents two inspection routes:
- Open
msinfo32.exeand examine Kernel DMA Protection. - In Windows Security, look under Device security → Core isolation details → Memory access protection, where available.
An enabled status confirms that Windows feature, not that every anti-cheat requirement has been satisfied.
Linux users faced a compatibility boundary
The Linux consequence deserves precise wording. Riot said League had never officially supported Linux, but acknowledged that the existing Lutris/Wine implementation could not satisfy Vanguard’s driver requirements. Its explanation cited difficulties attesting boot state and kernel modules.
That is different from withdrawing an officially supported Linux edition. Nevertheless, losing an unofficial route still matters to people who relied on it. The distinction clarifies responsibility without making the compatibility loss disappear.
What Windows players should take away
Start with the requirement actually being reported. Riot’s Vanguard tray application can show whether a machine meets Vanguard or Pre-Check requirements; qualifying players can investigate the optional mode rather than assume startup operation is unavoidable.
For administrators, the broader lesson is familiar: compatibility testing matters wherever software introduces kernel drivers or tighter driver policies. Microsoft’s own guidance warns that enforcing driver blocks without sufficient testing can disrupt devices and applications.
Vanguard’s story is therefore not proof that the open PC is finished. A more defensible reading is that competitive gaming increasingly depends on the integrity of the platform beneath it. The question is no longer just whether the PC is fast enough. It is which parts of that PC must be trusted—and how much third-party software must remain present to establish that trust.