Interactive Troubleshooter

Published: Oct 14, 2026

Vanguard and EAC Blocking Legitimate Games: How to Fix It

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

This interactive diagnostic decision tree resolves issues where kernel-level anti-cheat engines like Riot Vanguard and Easy Anti-Cheat (EAC) block legitimate software, cause blue screens of death, or prevent non-cheating multiplayer games from launching. It addresses UEFI Secure Boot enforcement, Windows Virtualization-Based Security (VBS) conflicts, vulnerable driver blocklists, and service initializations.

Full Diagnostic Tree & Step-by-Step Overview

What specific error message or blocking behavior occurs when launching a game protected by Vanguard or Easy Anti-Cheat?

Vanguard initialization error stating 'VAN9001' or 'This game requires TPM 2.0 and Secure Boot to be enabled'.
Easy Anti-Cheat (EAC) error throwing 'Untrusted System File', error code 30005, or blocking specific DLLs.
Game crashes immediately on startup with a Blue Screen of Death (BSOD) referencing `vgk.sys` or `EasyAntiCheat.sys`.
Anti-cheat blocks legitimate background overlays, performance monitoring tools (MSI Afterburner), or macro software.

What UEFI or BIOS boot configuration state is currently active on your motherboard?

Motherboard is running in Legacy CSM (Compatibility Support Module) boot mode instead of native UEFI.
Secure Boot is supported by hardware but currently disabled or set to 'Other OS' mode in BIOS.
TPM 2.0 (Trusted Platform Module) discrete or firmware PTT/fTPM is disabled in CPU security settings.
Disk partition style is MBR (Master Boot Record) preventing UEFI and Secure Boot activation.

Converting MBR to GPT and Enabling UEFI Mode for Vanguard

Solution:

Root Cause: Legacy CSM Boot Mode Incompatibility with Ring 0 Kernel Enforcers

Riot Vanguard and modern versions of Easy Anti-Cheat enforce strict kernel integrity requirements that mandate a modern UEFI (Unified Extensible Firmware Interface) boot environment with Virtualization-Based Security (VBS). If your motherboard is configured in legacy BIOS/CSM mode, Vanguard refuses to initialize, throwing VAN9001 or VAN9003 error codes.

Diagnostic Verification:

Press Win + R, type msinfo32, and press Enter.

Look for BIOS Mode. If it displays *Legacy*, your system is booting via CSM rather than native UEFI.

Step-by-Step Fix:

1Verify Disk Conversion Readiness via PowerShell (Admin):

Run Microsoft's disk validation tool:

mbr2gpt /validate /allowfullos

2Convert Disk from MBR to GPT Without Data Loss:

Run the conversion command:

mbr2gpt /convert /allowfullos

3Reconfigure Motherboard UEFI Settings:

Restart your PC and enter BIOS/UEFI setup (F2 or Del).

Change Boot Mode from *CSM / Legacy* to UEFI Only.

Enable Secure Boot and TPM 2.0 (fTPM/PTT).

Save changes and reboot into Windows.

4Verify BIOS mode now reads *UEFI* in msinfo32.

Prevention & Long-Term Monitoring:

Maintain UEFI boot settings and avoid enabling legacy compatibility modules on modern Windows 11 hardware.

Enabling UEFI Secure Boot in Motherboard BIOS

Solution:

Root Cause: Disabled Secure Boot Preventing Kernel Integrity Verification

Riot Vanguard loads at system startup (Ring 0 level) before the Windows kernel fully boots. To ensure the bootloader has not been compromised by rootkits, Vanguard requires UEFI Secure Boot to be strictly enabled. If Secure Boot is disabled or set to custom key mode without factory default keys, Vanguard blocks game execution.

Diagnostic Verification:

Press Win + R, type msinfo32, and check Secure Boot State. If it reports *Off* or *Unsupported*, Secure Boot is not active.

Step-by-Step Fix:

1Enter Motherboard UEFI BIOS:

Restart PC and tap Del or F2 repeatedly during POST.

2Navigate to Boot / Security Settings:

Locate the Security or Boot tab in your BIOS.

Find Secure Boot and set it to Enabled.

Ensure OS Type is set to Windows UEFI Mode (not *Other OS*).

If Secure Boot keys are missing, select Install Default Secure Boot Keys.

3Save and Exit (F10).

4Verify Secure Boot State reads *On* in msinfo32.

Prevention & Long-Term Monitoring:

Avoid clearing or modifying custom Platform Keys (PK) in BIOS unless required for specific dual-boot operating systems.

Enabling AMD fTPM or Intel PTT (TPM 2.0) in BIOS

Solution:

Root Cause: Disabled Hardware Trusted Platform Module (TPM 2.0)

Windows 11 and modern kernel anti-cheat engines utilize hardware-based cryptographic attestation via TPM 2.0 to verify platform integrity. If CPU-integrated firmware TPM (AMD fTPM or Intel Platform Trust Technology) is disabled in BIOS, Vanguard flags the system as unverified and blocks gameplay.

Diagnostic Verification:

Press Win + R, type tpm.msc, and press Enter. If it reports *Compatible TPM cannot be found*, TPM is disabled in BIOS.

Step-by-Step Fix:

1Reboot into UEFI BIOS Setup.

2Navigate to Advanced Security Settings:

AMD Systems: Look for AMD fTPM switch under *Settings > Security > Trusted Computing* and set it to AMD CPU fTPM.

Intel Systems: Look for Intel Platform Trust Technology (PTT) under *Advanced > CPU Configuration* and set it to Enabled.

3Save changes and reboot into Windows.

4Re-run tpm.msc to confirm *TPM 2.0 Specification Version is Ready for use*.

Prevention & Long-Term Monitoring:

Keep BIOS firmware updated to prevent intermittent fTPM stuttering bugs on AMD platforms.

Fixing Secure Boot Key Enrollment Failures and Custom Mode Lockouts

Solution:

Root Cause: Corrupted Platform Key (PK) Store and Custom Secure Boot Mode

Sometimes motherboard NVRAM stores corrupted Secure Boot certificates or locks the board in *Custom* mode rather than *Standard* mode. When this occurs, Windows and Vanguard cannot validate the signature chain, even if Secure Boot is toggled on in BIOS.

Diagnostic Verification:

msinfo32 shows Secure Boot State as *On*, but Secure Boot Mode displays *Custom* instead of *Standard*, and games still throw VAN9001 errors.

Step-by-Step Fix:

1Enter UEFI BIOS Setup during system boot.

2Navigate to Secure Boot Configuration Menu.

3Restore Factory Keys:

Select Clear Secure Boot Keys (if necessary).

Select Reset Secure Boot Keys to Factory Default or Install Default Secure Boot Keys.

4Ensure Secure Boot Mode switches from *Custom* to Standard.

5Save changes (F10) and restart Windows.

Prevention & Long-Term Monitoring:

Avoid toggling custom key enrollment options unless using specialized signed kernel modules.

What specific Easy Anti-Cheat (EAC) error code or file blocking prompt appears when launching the game?

Error code 30005: 'CreateFile failed; code 32' or error opening driver service.
'Untrusted system file' naming a specific Windows DLL (e.g., `version.dll` or `dxgi.dll`).
Error code 10011: 'Easy Anti-Cheat is already running' or service initialization timeout.
Game fails to launch due to Windows HVCI (Memory Integrity) blocking vulnerable driver files.

Resolving Easy Anti-Cheat Error 30005 (File Locking and Driver Conflicts)

Solution:

Root Cause: File Access Conflict or Residual Driver Service Locking (`Code 32`)

Easy Anti-Cheat error 30005 occurs when the kernel driver (EasyAntiCheat.sys) fails to initialize because the target file is locked by another running process, anti-malware software, or an orphaned service instance from a previous gaming session that failed to unload cleanly from memory.

Diagnostic Verification:

Attempting to delete or modify files inside the game's EasyAntiCheat installation directory prompts a *File in use by another program* warning.

Step-by-Step Fix:

1Terminate Stuck Game and Anti-Cheat Processes via PowerShell (Admin):

Run command to kill leftover background instances:

Stop-Process -Name EasyAntiCheat_EOS, EasyAntiCheat, gamelaunchhelper -Force -ErrorAction SilentlyContinue

2Stop and Delete Orphaned EAC Service Registry Key:

Open Command Prompt as Administrator:

sc stop EasyAntiCheat
sc delete EasyAntiCheat

3Repair Easy Anti-Cheat Service Binaries:

Navigate to your game's installation directory (e.g., C:\Program Files\Epic Games\<GameName>\EasyAntiCheat).

Run EasyAntiCheat_EOS_Setup.exe (or EasyAntiCheat_Setup.exe) as Administrator.

Click Repair Service.

4Relaunch game.

Prevention & Long-Term Monitoring:

Always close multiplayer games gracefully rather than force-killing processes during loading screens.

Removing Third-Party Mod DLLs and Re-verifying Game Files for EAC

Solution:

Root Cause: Modified Game Binaries or Hook DLLs Flagged as 'Untrusted System File'

Easy Anti-Cheat scans the game's root directory for unsigned or modified dynamic link libraries (.dll). If leftover files from previous mods, graphical reshade presets (e.g., dxgi.dll, d3d11.dll), or custom translation injectors remain in the game folder, EAC flags them as tampering attempts and blocks the game from launching.

Diagnostic Verification:

EAC error prompt explicitly lists an untrusted file path inside the game directory (e.g., GamePath\dxgi.dll).

Step-by-Step Fix:

1Delete Unauthorized Hook DLLs:

Navigate to your game's main installation directory.

Remove files such as dxgi.dll, d3d11.dll, version.dll, dinput8.dll, or ReShade.ini if present.

2Verify Integrity of Game Files via Client:

Steam: Right-click game in Library > Properties > Installed files > click Verify integrity of game files.

Epic Games: Click three dots under game card > Manage > click Verify.

EA App / Ubisoft Connect: Click game > Manage > Verify files.

3Launch game after file verification completes.

Prevention & Long-Term Monitoring:

Remove client-side graphical mods and visual injectors before launching strict multiplayer titles protected by kernel anti-cheat.

Fixing EAC Error 10011 (Service Initialization and Startup Failure)

Solution:

Root Cause: Windows Service Startup Failure or Aggressive Third-Party Antivirus Block

Error 10011 occurs when the Easy Anti-Cheat startup service fails to start automatically, or when third-party antivirus software (Norton, McAfee, Avast) quarantines EasyAntiCheat.sys as a potential root-level driver risk.

Diagnostic Verification:

Press Win + R, type services.msc, and press Enter. Locate Easy Anti-Cheat service. Check its Status and Startup Type. If startup type is *Disabled* or fails to start manually, the service is blocked.

Step-by-Step Fix:

1Configure Service Startup Type:

Open services.msc > right-click Easy Anti-Cheat > Properties.

Set Startup type to Manual or Automatic > click Apply and Start.

2Whitelist Anti-Cheat in Third-Party Antivirus:

Open your antivirus software settings > Exclusions / Quarantine.

Restore EasyAntiCheat.sys if quarantined and add an exception for the game's entire installation folder.

3Re-register EAC Service via Admin Command Prompt:

sc create EasyAntiCheat binPath= "C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys" type= kernel

4Relaunch game.

Prevention & Long-Term Monitoring:

Ensure anti-cheat directories are excluded from aggressive real-time antivirus scans.

Bypassing Windows Vulnerable Driver Blocklist Conflicts (HVCI)

Solution:

Root Cause: Windows Memory Integrity (HVCI) Blocklist Interference

Windows 11 features a Vulnerable Driver Blocklist (Hypervisor-Protected Code Integrity - HVCI) designed to block known kernel drivers with security flaws. However, this blocklist can occasionally flag legitimate older hardware utility drivers (such as RGB controllers, fan curves, or hardware monitors like SpeedFan/HWMonitor) or anti-cheat helper drivers, causing EAC or Vanguard to fail initialization.

Diagnostic Verification:

Open Windows Security > Device security > Core isolation details. Notice if Memory integrity is failing or if system logs cite blocked driver binaries (*.sys).

Step-by-Step Fix:

1Update or Remove Flagged Vulnerable Drivers:

Identify the blocked .sys file path mentioned in Windows Security notifications.

Update the associated hardware software package to the latest vendor version, or uninstall the conflicting utility.

2Temporarily Toggle Memory Integrity (If required for legacy hardware):

In Windows Security > Core isolation > toggle Memory integrity to Off (requires system reboot).

3Re-enable driver blocklist registry enforcement if necessary:

Open regedit > navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Config > ensure VulnerableDriverBlocklistEnable is set correctly.

4Restart PC and relaunch game.

Prevention & Long-Term Monitoring:span_0 span_0

Always keep system hardware utility drivers updated to prevent conflicts with Windows security baselinesspan_1 span_1.

What specific Blue Screen of Death (BSOD) stop code or driver filename is referenced during the crash?

BSOD stop code referencing `vgk.sys` (Riot Vanguard kernel driver crash).
BSOD stop code referencing `EasyAntiCheat.sys` or memory access violations.
BSOD referencing `PAGE_FAULT_IN_NONPAGED_AREA` or `SYSTEM_THREAD_EXCEPTION_NOT_HANDLED` during boot.
Random game freeze followed by crash to desktop without BSOD, but kernel logs show driver timeout.

Troubleshooting and Reinstalling Riot Vanguard (`vgk.sys` BSOD)

Solution:

Root Cause: Corrupted `vgk.sys` Kernel Driver Binary or Conflict with Overclocking Tools

Riot Vanguard runs vgk.sys at system startup. If the driver binary becomes corrupted due to an interrupted update or conflicts with low-level overclocking software (MSI Afterburner, RivaTuner Statistics Server, or custom fan controllers), the kernel panics, resulting in a Blue Screen of Death citing vgk.sys.

Diagnostic Verification:

Blue Screen of Death occurs upon booting Windows or launching Valorant/League of Legends, with the stop error pointing directly to vgk.sys.

Step-by-Step Fix:

1Uninstall Vanguard Completely via Appwiz.cpl:

Press Win + R, type appwiz.cpl, and hit Enter.

Locate Riot Vanguard > right-click > Uninstall.

2Delete Residual Vanguard Service Files:

Open Command Prompt as Administrator:

sc delete vgc
sc delete vgk

Navigate to C:\Program Files\Riot Vanguard and delete the folder entirely (if any files remain, restart PC in Safe Mode to delete).

3Reinstall Vanguard Cleanly:

Launch your Riot game client (Valorant or League of Legends) as Administrator.

The client will automatically download and install a fresh, uncorrupted copy of Vanguard.

4Restart PC as prompted.

Prevention & Long-Term Monitoring:

Close aggressive hardware overclocking and monitoring overlays before launching Vanguard-protected titles.

Purging and Reinstalling Easy Anti-Cheat System Files

Solution:

Root Cause: Corrupted `EasyAntiCheat.sys` Kernel Driver or Registry Hive Desynchronization

When the Easy Anti-Cheat kernel driver crashes or suffers memory corruption, Windows encounters a kernel exception when attempting to parse the driver's memory space, triggering a crash to desktop or BSOD.

Diagnostic Verification:

Event Viewer > Windows Logs > System displays Kernel-Power (Event ID 41) critical errors immediately following application crashes tied to EasyAntiCheat.sys.

Step-by-Step Fix:

1Delete Corrupted EAC Service and Driver:

Open Command Prompt as Administrator:

sc stop EasyAntiCheat
sc delete EasyAntiCheat

2Navigate to EAC System Directory and Purge Files:

Open C:\Program Files (x86)\EasyAntiCheat and delete the folder.

3Re-install EAC via Game Directory Setup:

Navigate to your game installation folder > locate EasyAntiCheat subfolder > run EasyAntiCheat_EOS_Setup.exe as Administrator > select Install.

4Verify game files through your game launcher (Steam/Epic).

5Restart computer.

Prevention & Long-Term Monitoring:

Regularly check disk health using SMART diagnostics to prevent system file corruption during game saves.

Disabling Overclocking Software and Undervolting Profiles Causing Kernel Instability

Solution:

Root Cause: CPU/RAM Instability Triggered by Kernel-Level Anti-Cheat Memory Checks

Kernel-level anti-cheat engines perform rigorous memory integrity validation and checksum checks across physical RAM and CPU cache registers upon launch. If your CPU is aggressively undervolted (via PBO, Curve Optimizer, or Intel XTU) or your RAM XMP/EXPO profile is unstable, these security checks trigger memory parity errors, crashing the system into a BSOD (PAGE_FAULT_IN_NONPAGED_AREA).

Diagnostic Verification:

BSOD stop codes vary (MEMORY_MANAGEMENT, SYSTEM_SERVICE_EXCEPTION), and crashes occur across multiple games or benchmarks, not just anti-cheat titles.

Step-by-Step Fix:

1Revert CPU Undervolt / Overclock in BIOS:

Reboot into BIOS setup > reset CPU core voltage, Precision Boost Overdrive (PBO), and memory XMP/EXPO profiles back to stock default values.

2Run Windows Memory Diagnostic:

Press Win + R, type mdsched.exe, and choose Restart now and check for problems.

3Test Game Stability:

Launch the game with stock hardware settings to confirm instability is resolved.

4Re-apply mild, verified stable overclocks incrementally if needed.

Prevention & Long-Term Monitoring:

Always validate overclocks using Prime95 or OCCT stability tests before running strict anti-cheat software.

Running SFC and DISM System File Integrity Repairs

Solution:

Root Cause: Corrupted Windows Kernel Component Store Binaries (`ntoskrnl.exe` / `ci.dll`)

Kernel anti-cheat drivers interface deeply with core Windows operating system binaries (ntoskrnl.exe, ci.dll, fltmc.sys). If core Windows system files are corrupted due to failed updates or unexpected shutdowns, kernel drivers fail to bind correctly, resulting in silent crashes or hangs.

Diagnostic Verification:

Running Windows Update throws installation errors, and running sfc /scannow reports unrepairable integrity violations.

Step-by-Step Fix:

1Open Command Prompt as Administrator.

2Run DISM Component Store Repair:

DISM /Online /Cleanup-Image /RestoreHealth

3Run System File Checker (SFC):

sfc /scannow

4Wait for both scans to complete and repair corrupted system files automatically.

5Restart PC and launch game.

Prevention & Long-Term Monitoring:

Avoid force-powering down workstations during active Windows cumulative updates.

What type of background overlay, performance tool, or peripheral software is conflicting with the anti-cheat?

MSI Afterburner, RivaTuner Statistics Server (RTSS), or GPU hardware monitoring overlays.
Custom macro software, mouse/keyboard remapping suites (Logitech G Hub, Razer Synapse, AutoHotkey).
Custom Windows themes, taskbar customizers (StartAllBack, ExplorerPatcher), or window managers.
Virtual machine hypervisors, WSL2 (Windows Subsystem for Linux), or sandbox environments active in background.

Configuring RTSS and MSI Afterburner Compatibility for Anti-Cheat

Solution:

Root Cause: Direct3D Hooking Interception Flagged as Overlay Injection

Performance monitoring tools like MSI Afterburner and RivaTuner Statistics Server (RTSS) inject hooks directly into game rendering pipelines (d3d11.dll, dxgi.dll) to display onscreen FPS and hardware telemetry. Kernel anti-cheat engines (Vanguard and EAC) flag these low-level rendering hooks as unauthorized memory injection attempts and block the game from starting.

Diagnostic Verification:

Game launches successfully only when MSI Afterburner and RTSS are completely closed from the Windows system tray.

Step-by-Step Fix:

1Update RivaTuner Statistics Server (RTSS) to Latest Version:

Newer RTSS builds include signed hooks explicitly whitelisted by major anti-cheat developers.

2Configure RTSS Application Detection Level:

Open RTSS > click the gear icon (Settings).

Set Application detection level to Low or Medium (instead of High/Custom).

Enable Use Extended Support or check Hide OS_D3D if applicable.

3Close MSI Afterburner before launching Vanguard-protected games (Valorant).

Prevention & Long-Term Monitoring:

Keep overlay software updated to ensure compatibility with kernel anti-cheat security filters.

Disabling Unauthorized Macro Software and Peripheral Driver Hooks

Solution:

Root Cause: Hardware Macro Engine and Driver Hook Restrictions

Kernel anti-cheat engines monitor input event pipelines to prevent hardware-level macro scripting, rapid-fire automation, and mouse smoothing exploits. Software like AutoHotkey (AHK), legacy macro recorders, or unverified peripheral remapping tools running in the background trigger anti-cheat heuristic blocks.

Diagnostic Verification:

Anti-cheat launch error references unauthorized input manipulation software or blocks background helper scripts.

Step-by-Step Fix:

1Terminate Background Macro Scripts and Automation Software:

Close AutoHotkey (AutoHotkey.exe), custom macro recorders, and unverified peripheral scripts from the Windows taskbar.

2Clean Official Peripheral Suites (Logitech G Hub / Razer Synapse):

Ensure peripheral software is updated to latest versions.

Disable hardware macro profiles assigned to game executable keys.

3Restart PC and relaunch game.

Prevention & Long-Term Monitoring:

Avoid running unverified input automation scripts while playing competitive multiplayer titles.

Disabling Taskbar Customizers and Shell Modifiers (StartAllBack / ExplorerPatcher)

Solution:

Root Cause: Explorer Shell Injection by Taskbar Modification Utilities

Third-party Windows shell modification tools like StartAllBack, ExplorerPatcher, or Windhawk inject DLLs directly into explorer.exe and running application processes to alter UI layouts. Kernel anti-cheats detect this shell tampering and block game initialization to prevent potential exploit vectors.

Diagnostic Verification:

Game refuses to launch while StartAllBack or ExplorerPatcher is active, but starts immediately after exiting the shell utility.

Step-by-Step Fix:

1Temporarily Close Shell Customizer:

Right-click taskbar modification tray icon and select Exit or Disable.

2Update Shell Modification Software:

Check for newer versions of StartAllBack or ExplorerPatcher designed for recent Windows 11 builds.

3Add Game Exclusion:

Configure shell utility settings to exclude the specific game executable from shell hook injection.

4Restart PC and test game launch.

Prevention & Long-Term Monitoring:

Keep shell customization software disabled during competitive gaming sessions.

Disabling Hypervisors, WSL2, and Virtualization Features Blocking Anti-Cheat

Solution:

Root Cause: Active Hypervisor Layers Conflicting with Ring 0 Kernel Enforcers

Kernel-level anti-cheats require exclusive access to Ring 0 kernel privileges. If Windows Virtualization-Based Security (VBS), Windows Subsystem for Linux (WSL2), Hyper-V, or third-party hypervisors (VirtualBox, VMware) are running active virtual machine monitors, anti-cheats detect the hypervisor layer as a potential security risk and block execution.

Diagnostic Verification:

Game error prompts state *Virtualization-Based Security is enabled* or *Running inside a virtual machine is prohibited*.

Step-by-Step Fix:

1Disable Hyper-V and WSL2 via Command Prompt (Admin):

Open Command Prompt as Administrator and run:

bcdedit /set hypervisorlaunchtype off

2Disable Virtual Machine Platform features:

Press Win + R, type optionalfeatures, and press Enter.

Uncheck Virtual Machine Platform, Windows Hypervisor Platform, and Windows Subsystem for Linux.

Click OK and restart PC.

3Relaunch game.

Prevention & Long-Term Monitoring:

Toggle hypervisor launch types off when switching between developer environments and competitive gaming sessions.

Related Diagnostic Guides

System Interrupts High CPU Usage 100% Fix Tree

NVMe SSD Not Showing Full Speed In CrystalDiskMark: PCIe Lane Diagnostic

Windows 11 File Explorer Slow To Load Green Bar Fix

Mechanical Keyboard Some Keys Double Typing: Debounce Diagnostic

AirPods Connected to Windows But Sound Is Low Quality: Hands-Free Profile Fix

Subscribe to StepDiag

Embed Guide on Your Website