Riot Vanguard HWID Bans — How They Work & How to Bypass

Riot Vanguard is the anti-cheat developed by Riot Games, originally released alongside Valorant in April 2020 and expanded to League of Legends in 2024. Vanguard now protects two of the most-played competitive games in the world — making it one of the most consequential anti-cheats for any spoofer to address.

What sets Vanguard apart is how deep it sits in the operating system. Unlike user-mode services that load with the game, Vanguard installs a kernel-mode driver (vgk.sys) that runs at boot via the vgc.exe service. By the time you log in to Windows, Vanguard is already active and watching. This early-load model is specifically designed to defeat any tampering tool that activates after Windows is up — by then, Vanguard has already captured a clean snapshot of your hardware.

Riot has been explicit about Vanguard's hardware-ban policy: bans are permanent, machine-bound, and there is no expiration. A single banned account flags the entire system. Creating a new Riot account on the same hardware results in an immediate re-ban, often within minutes of attempting to play. This makes Vanguard one of the few anti-cheats where partial spoofing — changing just a MAC or just a disk serial — reliably fails.

Vanguard collects identifiers through its kernel driver, which has direct access to system tables and hardware controllers. Because it loads before any user-space software, Vanguard reads hardware data in a state where most spoofers cannot intervene. The identifiers Vanguard tracks include:

Motherboard serial and SMBIOS data — Vanguard reads the system UUID, board serial, BIOS version, and chassis serial from SMBIOS tables exposed by the BIOS. These are the most persistent identifiers because they survive OS reinstalls and disk replacements.

Disk drive serial numbers — Vanguard queries every connected storage device for its firmware-level serial. NVMe, SATA, and external drives are all enumerated through the storage controller, not just Windows volume IDs.

CPU identifiers — Vanguard reads the CPU serial and instruction-level identifiers exposed via CPUID. This is uncommon among anti-cheats and adds an additional fingerprint dimension.

MAC addresses — every physical network adapter is logged. Vanguard distinguishes between physical and virtual interfaces and weights physical adapters more heavily.

TPM (Trusted Platform Module) data — on systems with TPM 2.0, Vanguard reads the endorsement key and platform certificate. This is mandatory for Valorant on Windows 11, where TPM cannot be disabled.

Windows installation identifiers — MachineGUID, hardware profile GUID, and the computer SID are read from the registry as supplementary signals.

Vanguard runs continuously while Windows is up — not just during gameplay. This means a spoofer that toggles on and off cannot defeat Vanguard, because Vanguard would have already seen the original hardware before the spoofer activated. The only effective approach is to permanently rewrite the underlying identifiers themselves, before Vanguard ever boots.

Cross-game enforcement is in place between Valorant and League of Legends. A hardware ban issued in Valorant prevents League play on the same machine, and vice versa. Both games share Vanguard's central ban database.

TraceX is built for exactly this scenario. Because Vanguard loads before any user-space software can intervene, real-time spoofers fail. TraceX takes a different approach — it permanently rewrites the hardware identifiers themselves. You run TraceX once, the underlying values change, and Vanguard reads the new values from then on as if they were always there.

All SMBIOS values — system UUID, board serial, BIOS version, chassis serial — are rewritten to clean values that pass Vanguard's format validation. Because the rewrite happens at the firmware/identifier level, vgk.sys reads the new values during its boot-time scan with no awareness of what was there before.

Disk drive serials are rewritten across all connected storage. NVMe, SATA, and removable drives all expose new firmware-level identifiers that Vanguard's storage queries return as genuine.

CPU identifiers and TPM data are addressed in the same pass — Vanguard's CPUID checks and TPM endorsement reads return clean values that match no entry in Riot's ban database.

MAC addresses are regenerated with valid OUI prefixes from real network hardware vendors. Vanguard's adapter enumeration sees standard hardware from known manufacturers, not obviously spoofed addresses.

Windows registry identifiers — MachineGUID, hardware profile GUID, computer SID — are rotated to values consistent with a fresh Windows installation.

Once TraceX has run, you can delete it. Nothing remains on your system. Vanguard boots, scans, and finds a completely new hardware identity. Because the IDs themselves are different — not masked at runtime — Vanguard has nothing to detect and no signature to match.