Riot Vanguard, Valorant's anti-cheat system, can enforce strict platform-security requirements on Windows 11. Two things must be active simultaneously: UEFI Secure Boot and TPM 2.0. If either requirement is unavailable or not detected, Vanguard can block the game from launching. This uefi secure boot valorant guide breaks down exactly what to check, how to enable the required settings safely, and how to clear the VAN9003 error without risky firmware experimentation.

Identify the Vanguard Warning

Valorant Vanguard error message VAN9003 about UEFI secure boot

Vanguard isn't just looking for a running Windows install - it checks security properties of the platform and boot process. On Windows 11, a disabled, missing, or undetected security requirement can prevent Valorant from launching.

The VAN9003 error indicates that Vanguard did not detect an acceptable Secure Boot state. It appears at launch and generally means Secure Boot is disabled, inactive, or not being reported correctly to Windows. TPM 2.0 is a separate Windows 11 requirement, and a TPM-related problem may produce a different Vanguard message or error code.

Here's what can trigger the Secure Boot check:

  • Secure Boot is turned off in firmware settings
  • Secure Boot is enabled in firmware but Windows reports it as off
  • Secure Boot is not fully configured because the required firmware keys are missing or invalid
  • The system is running in Legacy BIOS or CSM mode instead of native UEFI mode

That last point catches plenty of players off guard. You can have Secure Boot toggled "on" in your motherboard settings and still see VAN9003 because Windows is booting through a legacy path or otherwise reports Secure Boot as off.

Secure Boot and TPM 2.0 are separate platform-security features that can work together to support system-integrity checks. Vanguard requires the applicable features to be fully operational, not just partially enabled.

Check UEFI and Secure Boot in Windows

Windows System Information showing BIOS Mode as UEFI and Secure Boot State On

Before touching any firmware settings, confirm exactly what Windows currently sees. This takes under a minute and tells you precisely what needs fixing.

Check with msinfo32 (System Information):

  1. Press Win + R, type msinfo32, and hit Enter
  2. Look for BIOS Mode - it must read "UEFI", not "Legacy"
  3. Look for Secure Boot State - it must read "On"

Check TPM with tpm.msc:

  1. Press Win + R, type tpm.msc, and hit Enter
  2. Confirm the Specification Version shows 2.0
  3. Status should read "The TPM is ready for use"

If BIOS Mode shows "Legacy" or Secure Boot State shows "Off", additional changes are required before Valorant can run on Windows 11. These two tools provide the best first verification of what Windows detects - not just what a firmware menu claims.

For more platform configuration topics, browsing through our guides is a solid starting point.

Understand Legacy BIOS and CSM

This section matters more than most people expect. Secure Boot is a UEFI feature - it cannot operate through a Legacy BIOS boot path, and it requires CSM (Compatibility Support Module) to be disabled.

CSM allows older operating systems and bootloaders to use a legacy boot path on modern hardware. That path is incompatible with the native UEFI configuration required for Secure Boot. Disabling CSM is usually a prerequisite for Secure Boot to work, but doing so without preparation can stop Windows from booting.

The critical factor here is disk partition style for an installed Windows system:

  • GPT (GUID Partition Table) - required for native Windows UEFI boot
  • MBR (Master Boot Record) - normally used with Legacy BIOS or CSM boot

To check your disk's partition style, open Disk Management (diskmgmt.msc), right-click the system disk, select Properties, and look under the Volumes tab for "Partition style." If it shows MBR, you'll need to convert it to GPT or reinstall Windows in UEFI/GPT mode before safely switching away from Legacy boot.

Disabling CSM on an MBR-configured Windows installation can prevent Windows from booting. Always verify partition style before making firmware changes.

Enable Secure Boot and TPM Safely

Once you've confirmed GPT partitioning and understand what needs changing, entering firmware settings is the next step. The exact key varies by manufacturer - common options are F2, Del, F10, or F12 pressed at startup - but your motherboard manual has the definitive answer.

The general sequence, when your model exposes these options, is:

  1. Enter UEFI/BIOS firmware at startup
  2. Set the boot configuration to UEFI rather than Legacy
  3. Disable CSM / Legacy Boot support
  4. Enable TPM 2.0 - this may appear as "TPM," "fTPM," "PTT," or "Security Device" depending on your board
  5. Enable Secure Boot
  6. Save changes and exit

Back up important data before making any firmware changes. This isn't just a disclaimer - firmware edits can affect bootability, and having a recent backup reduces the risk of data loss if something goes wrong.

Incorrect BIOS or firmware changes can cause system instability or prevent Windows from booting entirely. Always back up data and follow your manufacturer's instructions precisely.

Fix VAN9003

UEFI BIOS Utility Advanced Mode screen showing OS Type selection

If Secure Boot appears enabled in firmware but msinfo32 still shows "Off," Windows is not seeing a fully active Secure Boot configuration. Possible causes include a legacy or CSM boot path, or a problem with the Secure Boot keys enrolled in firmware.

Check the Secure Boot configuration:

  1. Enter UEFI settings and navigate to the Secure Boot configuration
  2. Use your motherboard or PC manufacturer's documentation to check whether the platform is in the appropriate User mode and whether Secure Boot keys are present
  3. If the manufacturer's instructions identify missing keys, choose "Restore Factory Keys", "Install Default Keys", or the equivalent documented option
  4. Set Secure Boot to the enabled state specified by the manufacturer and save the configuration
  5. Ensure CSM is disabled and Boot Mode is set to UEFI

Menu names and the required order differ by model. Do not clear all Secure Boot keys or switch to a custom key configuration unless your manufacturer's documentation specifically requires it.

If Secure Boot still registers as off after this process, contact your motherboard or PC manufacturer's support rather than changing unrelated firmware settings or attempting an unsupported firmware procedure.

For MBR disks, the mbr2gpt tool built into Windows can convert a system disk to GPT without modifying or deleting data when its prerequisites are met, but conversion is not risk-free. Back up first and review Microsoft's documentation for that tool before using it.

For authoritative guidance straight from Riot, consult Riot Support's current Vanguard security-requirements and Secure Boot guidance for this issue.

Secure Boot must show as "On" in Windows System Information for Vanguard to accept the Windows-reported state. What your firmware displays is not enough by itself.

Motherboard-Specific Paths and Recovery

BIOS boot options menu with Windows Boot Manager highlighted

Menu names differ significantly between manufacturers. The option labeled "Secure Boot Mode" on one board might be buried under "Security Features" on another. Always consult your motherboard's official manual or support page for the exact navigation path.

Some common starting points by brand:

  • ASUS: On many ASUS boards, Boot → Secure Boot → OS Type → Windows UEFI Mode
  • Gigabyte: On supported Gigabyte boards, Advanced Mode → Boot → CSM Support, followed by Boot → Secure Boot → Key Management
  • Lenovo: On some Lenovo systems, Startup or Boot controls UEFI Only, while Security contains Secure Boot and TPM settings; key-management options vary by model

If Windows fails to boot after making changes, don't panic. Avoid repeatedly toggling platform-security settings and use these recovery steps:

  1. Enter the Windows Recovery Environment and try Startup Repair if it is available
  2. Re-enter firmware settings and verify that the Windows Boot Manager UEFI entry is selected, following your manufacturer's documentation
  3. If the system disk is MBR, stop forcing UEFI/Secure Boot and review Microsoft's MBR2GPT prerequisites before trying again
  4. Contact the PC or motherboard manufacturer if Windows remains unbootable

Do not attempt firmware flashing, registry edits, or unofficial bypass methods to resolve VAN9003. These approaches can compromise system security or stability and may leave Vanguard unable to validate the system.

Verify Vanguard After Restart

Trusted Platform Module (TPM) Management window showing TPM ready for use

With all changes saved, boot back into Windows and run the same checks from earlier.

Confirmation checklist in msinfo32 and tpm.msc:

  • BIOS Mode reads "UEFI"
  • Secure Boot State reads "On"
  • TPM Specification Version is 2.0
  • TPM status says "ready for use"

Every item must be correct before launching Valorant on a Windows 11 system with these Vanguard requirements. If Secure Boot shows incorrectly, VAN9003 can reappear; a TPM problem may generate a separate Vanguard requirement message.

Once every item is confirmed, launch the game. If VAN9003 is gone, you're done. If it persists despite correct system-information readings, follow Riot's current Vanguard troubleshooting steps or contact Riot Support rather than continuing to change firmware settings.

When to Stop and Contact Support

Some situations go beyond what self-troubleshooting can resolve. At that point, continuing to experiment with firmware settings creates more risk than it solves.

Stop and reach out for help if:

  • Secure Boot and TPM 2.0 both show correctly in Windows, but VAN9003 still appears
  • Windows fails to boot despite recovery attempts
  • The system doesn't support UEFI, Secure Boot, or TPM 2.0

For hardware-level limitations, contact your PC or motherboard manufacturer's support. For persistent Vanguard errors after confirmed correct system configuration, Riot Games support is the appropriate channel.

Avoid unsupported fixes found in forums or unofficial guides. The system-level changes involved here carry real consequences, and anything that bypasses Vanguard or disables platform security can create additional security or account problems rather than solve the issue.

Official source: Riot Games Secure Boot Guide