Interactive Troubleshooter

Published: Oct 19, 2026

Valorant TPM 2.0 Error VAN9001 on Windows 11 - Vanguard Diagnostic

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

Exhaustive diagnostic decision tree to resolve Riot Vanguard VAN9001 and VAN9003 attestation failures on Windows 11 caused by disabled firmware TPM 2.0, legacy MBR partition schemes, disabled Secure Boot states, and corrupted TPM endorsement keys.

Full Diagnostic Tree & Step-by-Step Overview

What specific error message or system state occurs when launching Valorant or Riot Vanguard on Windows 11?

VAN9001: 'VAN9001 error code indicates that TPM version 2.0 is not enabled or recognized'
VAN9003: 'Vanguard requires Secure Boot to be enabled in order to play'
TPM 2.0 is enabled in BIOS, but tpm.msc reports 'Compatible TPM cannot be found' inside Windows 11
VAN9001/VAN9003 persists despite TPM 2.0 and Secure Boot both showing 'Active' in msinfo32

What hardware platform and TPM status is reported by Windows Management Console (tpm.msc)?

AMD Ryzen system with fTPM disabled in BIOS firmware settings
Intel Core system (8th Gen or newer) with Platform Trust Technology (PTT) disabled in BIOS
System partition is using legacy Master Boot Record (MBR) scheme, blocking UEFI/TPM 2.0 attestation
Older CPU or motherboard lacking discrete/firmware TPM 2.0 support entirely

What is the current BIOS Mode and Secure Boot State listed under System Information (msinfo32)?

BIOS Mode is 'Legacy' or CSM (Compatibility Support Module) is enabled in motherboard settings
BIOS Mode is 'UEFI', but Secure Boot State is listed as 'Off' or 'Disabled'
Secure Boot is enabled in BIOS, but Secure Boot State displays 'Unsupported' due to factory keys missing

What underlying device driver or security feature is masking the TPM hardware device from the OS?

TPM Device Guard / Core Isolation Hypervisor code integrity blocking TPM driver initialization
Outdated motherboard BIOS firmware containing broken AMD AGESA or Intel ME TPM implementation

What system-level service or security policy is interfering with Riot Vanguard's kernel driver (vgc.sys)?

Corrupted Riot Vanguard installation or vgc service set to manual/disabled startup mode
TPM Endorsement Key (EK) or Platform Configuration Register (PCR) clearance required

Enabling AMD fTPM (Firmware TPM) in UEFI BIOS for Ryzen Processors

Solution:

Root Cause: Disabled AMD Firmware TPM (fTPM) in Motherboard UEFI

Riot Vanguard on Windows 11 enforces hardware-rooted attestation via Trusted Platform Module (TPM) 2.0 to prevent kernel-level cheat injection. On AMD Ryzen platforms, TPM 2.0 is embedded directly into the processor security subsystem as fTPM. If fTPM is set to 'Disabled' in motherboard BIOS, Vanguard blocks game launch with error VAN9001.

Diagnostic Verification:

1Press Win + R, type tpm.msc, and press Enter.

2If the console displays *'Compatible TPM cannot be found'*, fTPM is disabled in firmware.

3Verify AMD CPU platform in Windows System Information (msinfo32).

Step-by-Step Fix:

1Enter UEFI BIOS Setup:

Restart your PC and repeatedly press Del or F2 during motherboard POST splash screen.

2Locate AMD fTPM Setting:

ASUS: Go to Advanced > AMD fTPM Configuration > Set TPM Device Selection to Enable Firmware TPM.

MSI: Go to Settings > Security > Trusted Computing > Set AMD fTPM switch to AMD CPU fTPM.

Gigabyte: Go to Settings > Miscellaneous > Set AMD CPU fTPM to Enabled.

ASRock: Go to Advanced > CPU Configuration > Set AMD fTPM Switch to AMD CPU fTPM.

3Save and Exit:

Press F10, save configuration changes, and boot into Windows 11.

4Confirm Verification:

Run tpm.msc and confirm Specification Version: 2.0 with status *'The TPM is ready for use'*.

Prevention & Long-Term Monitoring:

Keep motherboard BIOS updated to the latest AGESA microcode to prevent fTPM stuttering or key loss.

Enabling Intel Platform Trust Technology (PTT) in UEFI BIOS

Solution:

Root Cause: Disabled Intel Platform Trust Technology (PTT)

Intel 8th Generation and newer processors integrate firmware TPM 2.0 under the feature name Intel Platform Trust Technology (PTT) via the Management Engine (ME). When PTT is disabled in UEFI, Windows 11 cannot access cryptographic key storage, causing Vanguard to generate error VAN9001.

Diagnostic Verification:

1Open PowerShell as Administrator and run:

powershell
   Get-Tpm

2If TpmPresent reports False, Intel PTT is currently turned off at the hardware firmware level.

Step-by-Step Fix:

1Access UEFI Firmware Settings:

Reboot the PC and enter BIOS using Del or F2.

2Navigate to Intel PTT Configuration:

ASUS: Go to Advanced > PCH-FW Configuration > Set PTT to Enable.

MSI: Go to Settings > Security > Trusted Computing > Set TPM Device Selection to PTT.

Gigabyte: Go to Settings > Security > Set Intel PTT to Enabled.

ASRock: Go to Security > Set Intel PTT to Enabled.

3Save and Reboot:

Press F10 to save changes and restart the computer.

4Test Game Launch:

Open Riot Client and launch Valorant to verify VAN9001 is resolved.

Prevention & Long-Term Monitoring:

Avoid clearing CMOS without backing up BitLocker or TPM credentials if full disk encryption is enabled.

Converting MBR Partition Scheme to GPT Using Microsoft MBR2GPT Tool

Solution:

Root Cause: Master Boot Record (MBR) Partitioning Preventing UEFI/TPM Attestation

TPM 2.0 and Secure Boot strictly require the operating system drive to use GUID Partition Table (GPT) architecture and boot via UEFI mode. If Windows 11 was installed or upgraded over a legacy disk using Master Boot Record (MBR), TPM 2.0 attestation cannot interface with kernel security features, throwing VAN9001.

Diagnostic Verification:

1Press Win + X and select Disk Management.

2Right-click Disk 0 (OS drive) > Properties > Volumes tab.

3Check Partition style. If it reads *Master Boot Record (MBR)*, non-destructive conversion is required.

Step-by-Step Fix:

1Validate Disk Readiness for Conversion:

Open Command Prompt as Administrator and run:

cmd
     mbr2gpt /validate /allowFullOS

Ensure output states *'Validation completed successfully'*.

2Convert Drive from MBR to GPT:

Execute the conversion command:

cmd
     mbr2gpt /convert /allowFullOS

3Switch Motherboard Boot Mode from CSM to UEFI:

Reboot into BIOS settings (Del/F2).

Navigate to Boot menu > Set CSM (Compatibility Support Module) to Disabled.

Set Boot Mode to UEFI Only.

4Save and Restart:

Press F10 to save and launch Windows 11 in native UEFI mode.

Prevention & Long-Term Monitoring:

Always verify OS drives are formatted as GPT before installing modern operating systems.

Addressing Legacy Hardware Lacking Native TPM 2.0 Modules

Solution:

Root Cause: Legacy CPU or Motherboard Lacking TPM 2.0 Hardware Support

Windows 11 requires TPM 2.0. While Windows 11 installation bypasses exist (e.g., registry modifications during setup), Riot Vanguard enforces a hard kernel check for TPM 2.0 on Windows 11. Systems utilizing 6th/7th Gen Intel or pre-Ryzen AMD CPUs lack firmware TPM 2.0 capabilities.

Diagnostic Verification:

1Check CPU model in msinfo32.

2Check motherboard header for a physical 14-1 pin TPM expansion slot.

Step-by-Step Fix:

1Option A: Install Discrete Hardware TPM 2.0 Module:

If the motherboard possesses an unpopulated TPM header, purchase a manufacturer-specific discrete TPM 2.0 LPC/SPI module (e.g., ASUS TPM-M FW 2.0, MSI TPM 2.0 Module) and install it on the motherboard.

2Option B: Revert System Operating System to Windows 10:

Riot Vanguard on Windows 10 does not strictly require TPM 2.0 or Secure Boot for Valorant play (subject to Riot anti-cheat policy updates).

Roll back or perform a clean installation of Windows 10 64-bit on older hardware platforms.

Prevention & Long-Term Monitoring:

Review Riot Games system requirement documentation before upgrading legacy PC hardware to Windows 11.

Disabling CSM (Compatibility Support Module) to Permit UEFI Secure Boot

Solution:

Root Cause: Active CSM (Compatibility Support Module) Blocking Secure Boot

Compatibility Support Module (CSM) enables legacy BIOS emulation for older operating systems and MBR drives. As long as CSM is enabled in motherboard firmware, UEFI Secure Boot cannot be engaged, triggering Riot Vanguard error VAN9003.

Diagnostic Verification:

1Press Win + R, type msinfo32, and press Enter.

2Check BIOS Mode. If it displays *Legacy*, CSM is currently active.

3Check Secure Boot State. It will display *Unsupported* while CSM is turned on.

Step-by-Step Fix:

1Confirm GPT Disk Format:

Ensure primary boot drive is formatted as GPT (refer to Node 203 if MBR conversion is needed).

2Reboot into Motherboard BIOS:

Restart PC and press Del or F2.

3Disable CSM:

ASUS/MSI/Gigabyte/ASRock: Navigate to Boot menu > CSM (Compatibility Support Module) > Set Launch CSM or CSM Support to Disabled.

4Enable Secure Boot:

Navigate to Security or Boot > Secure Boot > Set Secure Boot to Enabled.

5Save and Boot:

Press F10 to save settings and launch Windows 11.

Prevention & Long-Term Monitoring:

Never enable CSM on modern Windows 11 UEFI systems to prevent breaking boot security chains.

Activating UEFI Secure Boot in Motherboard Firmware Settings

Solution:

Root Cause: Disabled UEFI Secure Boot State

Windows 11 is operating in native UEFI mode, but the Secure Boot validation mechanism is turned off (Off or Disabled) in motherboard settings. Riot Vanguard requires active Secure Boot to ensure bootloader integrity and prevent ring-0 hypervisor rootkits.

Diagnostic Verification:

1Open System Information (msinfo32).

2Verify BIOS Mode is *UEFI* and Secure Boot State reads *Off*.

Step-by-Step Fix:

1Open UEFI Settings via Windows Advanced Startup:

Go to Windows Settings > System > Recovery.

Click Restart now next to *Advanced startup*.

Select Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.

2Enable Secure Boot:

Navigate to Security or Boot tab.

Change Secure Boot status to Enabled.

Set Secure Boot Mode to Standard.

3Save and Exit:

Press F10 to save changes and restart into Windows 11.

4Verify in Windows:

Check msinfo32 to confirm Secure Boot State: On.

Prevention & Long-Term Monitoring:

Avoid modifying Secure Boot configuration options when testing unverified third-party operating systems.

Restoring Factory Secure Boot Keys (PK/KEK/db) in Custom BIOS States

Solution:

Root Cause: Missing or Uninitialized Factory Secure Boot Keys

In custom-built PCs or motherboards shipped in 'Custom' Secure Boot mode, Secure Boot may appear enabled in BIOS settings while Windows reports Secure Boot State as 'Off' or 'Unsupported'. This happens because the platform default cryptographic keys (Platform Key PK, Key Exchange Keys KEK, and Signature Database db) are not loaded into NVRAM.

Diagnostic Verification:

1Open msinfo32 and observe Secure Boot State: Off despite enabling Secure Boot in BIOS.

2In BIOS Secure Boot setup, observe Key Management showing *Uninitialized* or *Custom*.

Step-by-Step Fix:

1Access BIOS Key Management:

Reboot into BIOS (Del/F2) > Go to Security > Secure Boot > Key Management (or Advanced Secure Boot Keys).

2Reset Secure Boot Keys to Factory Defaults:

Select Restore Factory Keys or Reset to Setup Mode, then choose Install Default Secure Boot Keys.

3Set Secure Boot Mode to Standard:

Change Secure Boot Mode from *Custom* to Standard.

4Save and Reboot:

Press F10 to save changes and enter Windows 11.

Prevention & Long-Term Monitoring:

Do not clear Platform Keys (PK) unless performing custom Linux kernel signing operations.

Configuring Windows Device Guard and Core Isolation Hypervisor Settings

Solution:

Root Cause: Hypervisor Enforced Code Integrity (HVCI) Masking TPM Interface

Virtualization-based Security (VBS) or Memory Integrity (HVCI) under Windows Security can occasionally block hardware pass-through access to the TPM 2.0 security chip if virtual machine platform extensions or third-party hypervisors interfere with Windows kernel security calls.

Diagnostic Verification:

1Open Windows Security app > Device security.

2Click Core isolation details.

3Check if Memory integrity toggle causes driver conflict errors on boot.

Step-by-Step Fix:

1Reset TPM Security Provisioning:

Press Win + R, type tpm.msc, and press Enter.

Click Clear TPM under Actions pane (Note: Ensure BitLocker is suspended first if active).

2Re-enable Memory Integrity:

In Windows Security > Core isolation details, toggle Memory integrity to On.

Restart your PC when prompted.

3Verify TPM Binding in PowerShell:

Open PowerShell as Administrator and run:

powershell
     Clear-TpmAutoProvisioning
     Enable-TpmAutoProvisioning

Prevention & Long-Term Monitoring:

Ensure third-party virtualization software (VMware, VirtualBox) is kept updated to avoid hypervisor driver collisions.

Updating Motherboard BIOS Firmware to Resolve fTPM AGESA Bugs

Solution:

Root Cause: Broken Motherboard BIOS Firmware fTPM Implementation

Early Windows 11-compatible BIOS releases (specifically older AMD AGESA 1.2.0.3/1.2.0.5 builds) contained firmware bugs that caused periodic fTPM micro-stuttering, key corruption, or intermittent TPM 2.0 device dropping during high system load, causing Vanguard to drop attestation mid-game.

Diagnostic Verification:

1Check current BIOS version:

Press Win + R, type msinfo32, press Enter, and read BIOS Version/Date.

2Check motherboard manufacturer support page for updated firmware releases referencing fTPM or Windows 11 fixes.

Step-by-Step Fix:

1Download Latest Official BIOS:

Visit motherboard vendor official website (ASUS, MSI, Gigabyte, ASRock) and download the latest stable BIOS build.

2Flash BIOS via EZ Flash / M-Flash:

Extract BIOS file onto a FAT32-formatted USB flash drive.

Reboot into BIOS setup and launch motherboard update utility (e.g., ASUS EZ Flash 3, MSI M-Flash).

Select BIOS file and complete flashing process without interrupting power.

3Re-enable fTPM and Secure Boot Post-Flash:

After firmware flash completes, re-enter BIOS to verify fTPM/PTT and Secure Boot remain Enabled.

Prevention & Long-Term Monitoring:

Update BIOS regularly whenever major OS hardware security requirements change.

Reinstalling Riot Vanguard and Configuring System Service Startup Modes

Solution:

Root Cause: Corrupted Riot Vanguard Service (vgc) Configuration

Even with TPM 2.0 and Secure Boot active, error VAN9001 can occur if the Riot Vanguard kernel driver (vgc.sys) or system service (vgc) fails to start automatically during Windows boot, or if service permissions are modified by third-party optimization software.

Diagnostic Verification:

1Press Win + R, type services.msc, and press Enter.

2Locate Vanguard Notification Service (vgc). Check if Startup Type is set to *Automatic* and Status is *Running*.

Step-by-Step Fix:

1Configure Service Startup:

Right-click vgc service > Properties.

Set Startup type to Automatic.

Click Start if service is currently stopped.

2Clean Reinstall Riot Vanguard:

Open Settings > Apps > Installed apps.

Find Riot Vanguard, click options, and select Uninstall.

Open Command Prompt as Administrator and execute:

cmd
     sc delete vgc
     sc delete vgk

Restart your PC.

Launch Riot Client and open Valorant to prompt automatic Vanguard reinstallation.

3Reboot Machine:

Restart system after reinstallation to initialize kernel drivers.

Prevention & Long-Term Monitoring:

Exclude C:\Program Files\Riot Vanguard from aggressive third-party antivirus real-time scanning rules.

Clearing TPM Endorsement Keys (EK) and Resetting PCR Measurements

Solution:

Root Cause: Stale or Corrupted TPM Endorsement Key (EK) Measurements

If motherboard hardware configurations, CPU chips, or BIOS settings were modified without clearing the TPM security chip, existing Platform Configuration Register (PCR) measurements stored in TPM NVRAM can fail validation checks performed by Riot Vanguard attestation servers.

Diagnostic Verification:

1Run PowerShell as Administrator:

powershell
   Get-TpmEndorsementKeyInfo

2Check for validation warnings or missing EK certificates.

Step-by-Step Fix:

1Backup Important Credentials:

Ensure BitLocker or other encryption keys are backed up, as clearing TPM erases stored credentials.

2Clear TPM Credentials via Windows Settings:

Go to Settings > Privacy & security > Windows Security > Device security.

Click Security processor details > Security processor troubleshooting.

Select Clear TPM and click Clear and restart.

3Confirm Hardware Prompt:

During reboot, press F1 or Y when prompted on screen by motherboard firmware to confirm TPM clearance.

4Relaunch Game:

Boot into Windows 11, open Riot Client, and verify Valorant connects successfully.

Prevention & Long-Term Monitoring:

Always clear TPM state when swapping CPUs or upgrading motherboard components.

Related Diagnostic Guides

Windows Update Error 0x80070002 Missing Files Diagnostic Guide

System Restore Failed 0x80070005 Antivirus Conflict Tree

Windows Photo Viewer Not Showing Thumbnails: Codec Diagnostic

Safe Mode Password Not Working With Microsoft Account Fix

Clipboard History Not Working Windows 11: Sync Service Tree

Subscribe to StepDiag

Embed Guide on Your Website