Updated 26 October 2026: the page now opens with the Windows 11 25H2 message that most readers search for. Riot’s requirement list is unchanged since the 24 June announcement.
Riot Vanguard asks for Windows 11 25H2 or later because its On-Demand mode depends on a Windows feature that older builds lack. Vanguard On-Demand loads Riot’s anti-cheat driver when you start a Riot game and unloads it when you close the game, in place of loading it at Windows startup. To use it, your PC must pass the Vanguard Pre-Check: Windows 11 25H2 or later, UEFI boot with Secure Boot, TPM 2.0, Virtualization-Based Security with HVCI, and IOMMU. The mode is optional; if you change nothing, Vanguard keeps working as before.
Why Vanguard needs Windows 11 25H2
Riot’s announcement of 24 June 2026 tells players to update to at least Windows 11 25H2, because earlier builds lack the runtime driver attestation report that On-Demand reads. Windows 10 and Windows 11 23H2 or 24H2 cannot qualify, however clean the BIOS settings are. At launch Riot said that about 35% of players met every requirement, about 62% could qualify by switching settings on, and about 3% had hardware too old to pass.
What the Vanguard Pre-Check requires
Six items, all Windows security features: Windows 11 25H2 or later, UEFI boot mode, Secure Boot, TPM 2.0, Virtualization-Based Security with Hypervisor-Protected Code Integrity, and IOMMU. Some boards need a BIOS update before the last two appear. Microsoft’s VBS and HVCI guidance lists the same base: a 64-bit CPU with virtualisation extensions, SLAT, TPM 2.0, Secure Boot and every DMA-capable device behind an IOMMU.
How to check your PC for Vanguard On-Demand
- Open the Vanguard tray icon (VGTray) and read the Pre-Check panel; it lists each unmet requirement.
- Press Win+R, type winver and press Enter. The version must read 25H2 or higher.
- Press Win+R, type msinfo32 and press Enter. In System Summary, BIOS Mode must read UEFI and Secure Boot State must read On.
- In the same window, Virtualization-based security must read Running.
- Press Win+R and type tpm.msc. Specification Version must read 2.0.
How to turn on Secure Boot, TPM 2.0 and memory integrity
Make the Windows change first, then the firmware changes, and back up your data before you change firmware settings.
- Open Windows Security, then Device security, then Core isolation details, and turn Memory integrity on. Restart.
- Confirm in msinfo32 that BIOS Mode already reads UEFI.
- Restart into firmware setup: Settings, System, Recovery, Advanced startup, Restart now, Troubleshoot, Advanced options, UEFI Firmware Settings.
- In the security or trusted computing section, enable the firmware TPM; your board manual gives the exact name.
- Enable IOMMU in the CPU or chipset section: VT-d on Intel boards, AMD-Vi on AMD boards.
- Turn CSM off and Secure Boot on, save, restart and run the Pre-Check again.
Secure Boot works only when Windows boots in UEFI mode from a GPT disk. On a legacy or CSM install on an MBR disk, turning Secure Boot on leaves the PC unable to boot, and a second operating system with an unsigned bootloader also stops starting.
Why the Vanguard Pre-Check still fails
- Everything looks enabled. Check winver: anything below 25H2 fails. Install the feature update and run the check again.
- TPM looks on and is rejected. In tpm.msc, version 1.2 is the wrong generation. If Windows reports no compatible TPM while the BIOS shows one, the board usually points at an empty discrete TPM header; switch the source to the firmware TPM.
- Secure Boot is on and the PC will not start. This is the MBR case. Set the firmware back to legacy, start Windows, suspend BitLocker, then run mbr2gpt.exe /validate /disk:0 and, if it passes, /convert /disk:0 /allowFullOS. Microsoft warns that the firmware must then switch to UEFI and that the conversion is permanent.
- On-Demand is on and Vanguard still loads at startup. Either the client update with the toggle has not reached you, so launch the game once to patch, or memory integrity failed because a driver blocked it; Core isolation details names that driver.
Does On-Demand change kernel access?
The driver is still kernel-mode with the same reach; the change is timing. Vanguard reads Windows’ runtime driver attestation report at game launch to see what loaded while it was off. As Tom’s Hardware put it, the access scope has not meaningfully shrunk. Turning VBS and HVCI on can cost a few frames per second and break older device drivers.
Frequently asked questions
Why does Riot Vanguard say Windows 11 25H2 or later?
The message belongs to Vanguard On-Demand. That mode reads a runtime driver attestation report that only Windows 11 25H2 and newer provide, so older Windows builds cannot pass the Pre-Check. Install the 25H2 feature update to qualify.
Is Vanguard On-Demand mandatory?
No. Riot calls it fully optional, and players who change nothing keep the current always-on behaviour, also in ranked play.
Can I go back from On-Demand to always-on?
Riot’s announcement does not describe a way back after you switch, so treat it as unconfirmed and leave the toggle off if you need that certainty.
Sources
- Riot Games, Vanguard On-Demand, 24 June 2026
- Microsoft, OEM VBS and HVCI requirements
- Microsoft, Core isolation
- Microsoft, MBR2GPT
Prepared by the GamerMarkt editorial team, with some help from AI tools; some images may be AI-generated.
