Vanguard error -> dodge timer -> 15 min penalty.
I just had one of the most infuriating experiences I’ve ever had with League.
I was debugging a Windows issue using Procmon with custom filters. After finally capturing the exact log I needed, Vanguard (Vanshit) threw a 1067 error, killed the League client, and slapped me with a 15‑minute dodge penalty.
Then it got worse.
Vanguard kept crashing on startup, so I rebooted.
And because Windows 11’s clipboard history is volatile, every single log, filter, and note I had was wiped. Hours of work gone because Riot’s anti‑cheat can’t handle normal system tools without panicking.
At this point Vanguard behaves more like a kernel‑level rootkit than a normal anti‑cheat:
- It crashes when legitimate diagnostic tools run
- It kills the game client
- It forces a reboot to recover
- It interferes with overlays like Game Bar
- It provides zero transparency when it fails
I get that anti‑cheat needs deep access, but this level of fragility is unacceptable. No other game on my system behaves like this. If Vanguard can’t coexist with standard Windows tools, that’s a design flaw and fking not a user problem.
Riot really needs to address this. Vanguard shouldn’t be this unstable, this intrusive, or this hostile to normal system debugging.
Base your documentation on something else than clipboard history, it simply never works when you need it to.
Good post though!
I am pretty sure vanguard started disabling every USB device for like 15-30 seconds since* a few days every few games for me. I can hear the "USB disconnected" windows sound and my mouse, my keyboard, my mic etc stop working while my game and videos on my other monitor still work perfectly fine. I don't have this issue in anything except league and valorant.
I never put it together, but that makes sense, even happens mid game during valorant for me....I always thought my cables were maybe loose
So that's the fucking sounds I've been hearing for months
Vanguard made my fans not working on startup it overheat so bad shutted down itself few times.
Also one time bcs of it my gpu wasnt recognized by windows for some reason needed a lot of diagn tool to work.
Uninstalled not a single problem after,so well...
perfect logic, anticheat driver makes fans stop working
Well,if it was only me,but on another thread here and on tech support this was the cause in multiple instances
of course the official tech support website, document it or it didn't happen
It can disallow drivers for fan control to be loaded, so it's not impossible.
does it make sense to you that an anti cheat driver would disable computer fans
...you either did not read or did not understood the comment which you replied to.
The problem with Procmon is that the moment you run it, it installs a driver to hook certain WinAPI functions in order to do those file/reg/tcp query logging in the first place, this is a big nono for the anticheat, but the real issue is that the driver does not (and will never) unload when you quit Procmo, Sysinternal never codedit. Therefore unfortunately you have no choice but to restart the PC in order to play the game again
Vanguard is supposed to let you know this (even telling you directly that you can Procmon and you need to restart).
But you never got the error message, so that sucks.
Also to disable the game bar. You just need to go to settings, then type "Xbox" and then disable the Xbox game bar. Happy Windows LTSC
Current windows and vanguard, 2 things that should be very illegal.
why would either of those be illegal
Bro, with all these issues you are better playing other games. Nothing that riot offers is worth the spyware
I wouldn't be surprised if they were mining Bitcoin with your PC while it's running 😂
This is why you use a seperate boot/SSD for all these spyware anticheat games
Separating boot and game does nothing in this case Sherlock. Vanguard is a Kernel level anti-cheat. If you’re not sure what that means, just know that separating a League installation to a separate drive does nothing.
It's in your operating system kernel. Not your BIOS. Which is also why it's limited to Windows.
Riot gives 0 fucks about 1000 people having vanguard issues when 1,000,000 are fine. Check my post history. I dealt with this for months and months and months. To the point my pc was unsuable. Could not even boot it on with out blue screening to a vanguard error. Its obvious to this point people are fine with riot having more access to your pc than you do. I have a really nice pc. Bought the best parts you can buy in 2025. Still can't play Rust and have riot client open.
Absolutely all ring 0 "anti-cheat" tools are a rootkit (virus) on your machine. The only difference is you installed it yourself granting approval over a hacker injecting it through an exploit. Honestly, if they actually worked it might even be worth it. But every single anti-cheat rootkit still has cheaters plaguing there games. Every, single, one.
Randomly started getting disconnects/dodges due to a vanguard error. Uninstalled everything/reinstalled didn’t work. My computer didn’t have much on it anyways so did a clean windows reinstall and still did it. My computer being Ethernet hardwired was somehow the issue. Still don’t understand how/why and had to play without for a while.
Back when i used to play I never noticed any cheaters in my games. Either there were none or they were so good at hiding it that it might as well not be affecting the game at all so I fail to see the reason of vanguard's existence to begin with. Especially since I don't even want to play league, I just want to play some TFT but this dumb company who claims to have so much experience can't figure out how to make the gamemode work without the league client. and you can't use the league client without installing riot's malware.
Vanguard should be banned it doesn't stop cheating and doesn't stop bots.
Only thing it does is slow down your device and spy on users.
true! i have one mid ssd and one rly good ssd and both can't handle the game at all. there r some instances where it gets disk usage 100%! did some "fixing" and it worked for a few days then randomly started to happen again (mostly when announcer for the kill happens), then i started to play urf where it literally became unplayable that i just left the game and delted it! also i mofified my hosts file to block their website to not tempt myself to reinstall it! it feels like the game has more bugs than any other game!
yup vanguard is really fuckin invasive
Here's a thought.
Close Riot Vanguard before running a diagnostic tool.
Then if the need to play league arises restart the pc.
Problem solved.
Never had an issue with Game Bar and Vanguard personally.
The entire point of not providing transparency when failing is to prevent cheat developers from knowing which tripwire they tripped in their program. So that part is never going to go away.
Or like other kernel level anticheats, vanguard could just open and close with the application, and not be the invasive piece of shit it is.
That's eventually coming.
But they decided the tradeoff was worth it considering how much harder they'd make cheating compared to the burden they'd place on their players. They couldn't just wait for Microsoft to fix their own kernel security so they made vanguard launch at boot as a band-aid until Microsoft actually does a better job of securing that space from cheaters and viruses.
Only 30 mins? Has prob vost me 10s of hours of debugging
HAH, my friend I am 15 emails with support deep and 3 months later after trying every possible "fix" they threw at me, Vanguard still crashes.
The Fix? I just deleted the game.
Absolutely, never ever use Vanguard in your main OS.
Buy a drive, put a clean windows installation on it and League only and always keep all your drivers (and BIOS) up to date.
Also, ensure that your other drives are kept offline (not mounted) all the time(not that this can stop Vanguard entirely from being capable of accessing them if it is made to do so in the future but it's not doing that so far, either that or use BitLocker if you are ok with possibly losing the data in your main OS, last resort and very inconvenient and crazy way is to remove your main OS drive so physical access to it is completely impossible to be gained no matter what).
Edit: In this comment, i do not imply that Vanguard is technically unable to read the contents of a drive if it is not mounted, but its default behavior is being prevented doing so if they are not mounted to begin with and there's no proof that just because the access level it has, it's actually doing that.
BUT this is exactly why i said to keep them offline, because regardless of what happens, example, if a very malicious and skilled person gains access to Vanguard, they are more likely to attempt to mount a drive than pull things around via Vanguard to read a drive's content, and that's where most users can actually notice that happening.
There's a ton of steps required for anyone, to try to access a drive without mounting it via Windows.
To access a drive in such raw way you must avoid corrupting data or crashing the system while you are performing lows of low level IO operations and that can be detected by the OS itself (and interfering with it can cause either data corruptions and/or BSODs).
EVEN if this not the case, and you see an offline drive being mounted when Vanguard is working, you should be worried regardless if it's Vanguard doing it or anything else.
This feels like insanely overkill. At this point just don’t play league
It's overkill to care about your system's safety and stability, gotcha.
If it's system safety you care about, dont play these games with intrusive anticheats because there is no way you'll get around their intrusiveness. You are giving them unrestricted access and if it's security you care about you would not play the game for the sake of these issues. We know that riot will not change the way how vanguard works because its a deterrent against cheaters. Legit just go play a different game. Go play Dota 2 it's also a MOBA without an intrusive anticheat
Exactly and i have advocated for this since Vanguard was implemented and released, but i also have provided balanced workarounds as solutions relatively decent solutions for people who don't want to stop being able to play entirely.
Straw man argument. I never said that it’s overkill to care about your system’s safety. I care about the safety of my system quite a bit, but buying a seperate physical drive and manually unmounting drives to play a video game is an extremely impractical solution for 99% of people. There’s a middle ground somewhere between no security and extreme paranoia
You don't have to manually unmount drives, you can permanently set them offline when you are in the "League/Valorant OS".
I forgot to mention, it's not just safety but stability as well.
I'd rather have a disposable OS on a side drive fail because of Vanguard than someone's main OS.
You should see what happens to people who get hacked and had very important stuff stored in their PCs.
Since vanguard is kernel level, can they not still access the drives if they really want to? Since they’re not physically disconnected, I don’t see why they can’t just reactivate the drives and access the data. (I believe you might have alluded to something similar in your first comment?)
And if someone is smart enough to compromise all of riot vanguard, then they’re definitely smart enough to get past this.
Also, buying another drive to run a seperate windows install on is also more effort than 90% of people are willing to do, not to mention the cost of buying more storage. To me this also seems overkill, and probably not secure enough if you’re willing to go this far.
Edit: asked a cybersecurity friend of mine who confirmed that marking the drives offline is practically useless since vanguard is kernel level.
It can mount drives but that would show in windows logs, unless it tried to do that differently like reading straight from ring 0 level, but that require having a driver to do so and generally, you can actually measure that indirectly via other windows logs and metrics.
So far no research has found that Vanguard has such behavior at all, but it's not impossible that it can do it IF Riot coded to do so, given the level of access it has.
Making drives offline at least prevents its default scanning behavior.
What is even the point then? If vanguard gets compromised then the hackers won’t care about default scanning behavior or whatever. I believe someone else commented about it, but vanguard wouldn’t even need to mount the drives to read the data… also people don’t usually check their windows logs every day.
This whole thing seems totally pointless security wise and a waste of time and money unless you physically disconnect the drives, and even then it feels really overkill imo.
Chiming in here real quick, unmounting drives in windows or setting them offline does not work against vanguard. Setting them offline restricts anything that runs at the user layer and not the kernel layer. Windows just sets a flag and vanguard does not care to obey that flag that windows set. It can read sectors without mounting a filesystem, and set the disk online or send I/O requests. While OP's frustration is understandable they should not be storing important stuff in the clipboard or just use the pin feature in the clipboard so you dont lose it.
eh i’ve never had one problem across 7 computers/laptops(dropped and broken) multiple different OS and ts never happens to me
"Multiple different OS" is very fuxking funny, considering Vanguard only runs on a single OS (all others would never in a million year let Vanguard do what it's doing).
But yeah good meme!
Windows? MacOS? are those not different Operating systems?
Vanguard doesn't run on macOS (Apple would never let Riot on their kernel), they just renamed the "old" anti-cheat. Of course you can't have problem there!
I am glad it's working for you, but we are not talking about cases like yours, so i don't see how your input helps.
Because cases like what you described are incredibly rare and almost all the time not due to Vanguard.
Sounds like a penalty well deserved
Looking at your comments in all threads, you, or I better say "it" is always commenting the same no matter the context. It it's not a bot, then "it" is even worse - a troll!
Care to elaborate? What waas well deserved and why?
This is pure troll comment!
If it prevents you to run these diagnostic tools that means they have potential to be exploited in some way like a lot of drivers cant run during gameplay because they are known to be vulnerable, vanguard is so opaque about what happens because that slows down exploit development. These hurdles 1% of people have to deal with is a small price to pay to be known as first anticheat system which won "cat and mouse" game, vanguard cheats are extinct, last time I checked year ago only dma pixel aimbots existed and ive heard they have been cracking down on dmas for a while now
2 weeks ago I got a restriction because I called a racist guy a racist, yes, nothing more, but apparently the simple repetition use of the term is enough to get a sanction.
-> I made a ticket and the guy just told me that I "should not escalate with people in the chat" ; the guy didn't lift my sanction and of course, the racist in question got no sanctions
1 week ago, I had 4 vanguards issues in a row, after the champ select, so I was temporaly banned from ranking queue
-> I made a second ticket, got an answer asking for the specific vanguard error 3 days later, no answers since
So riot has deep access in our computer via vanguard but vanguard itself can't do it's job properly AND you can get a sanction if it doesn't work properly ... but hey, apparently we don't have bots anymore (nope).
deserved
First cry baby racist spotted.
Well you deserved the ban for sure.
So you created a negative environment for 8 others (possibly 9) so you could argue with someone
"Arguing" is a big term, the guy made a dozen racist commentaries, I said "enjoy the ban you racist piece of shit", that's all.
If you believe calling out racism is "creating a negative environment", I understand a bit better riot moderation's position on the matter.
Yea him being racist doesn’t excuse your negative behavior.
Also, was what they said even racist or something you inflated to racism.
Based on the info shared you are a problem. We have no evidence on them but your word
So much whataboutism
You recognize a fault of you
Why are you using diagnostic tools on Vanguard? Are you a Riot employee?
That’s the typical behavior of the hackers trying to investigate how Vanguard works to find ways to overcome it. That makes total sense that you got flagged for doing this. Be prepared for the perma ban in a few days/weeks because the strategy according to the Dev blog has always been to delay perma ban so that hackers can’t guess exactly what triggered it.
I wasn’t 'investigating Vanguard' and I’m definitely not a Riot employee.
I was debugging a Windows Game Bar issue that started after the latest update. The Game Bar throws an error popup every time a League game launches, so I used Procmon to trace which system events trigger it.
Vanguard crashed during that process, which is the entire point of my post: normal Windows diagnostic tools should not cause the anti‑cheat to panic, kill the client, and force a reboot. That is incredibly intrusive and I already uninstalled this virus.
There’s a point where software becomes more trouble than it’s worth, and Vanguard crossed that line for me. I’m not going to compromise the usability of my own PC just to keep a game running. Only people who don’t value their own time could tolerate software this invasive. At some point you either draw a line or let the system waste hours of your life, and I’m not doing the latter.
Well there is nothing new here. As a developer yourself you should know that Vanguard and other kernel anti cheat are the only solutions to seriously mitigate cheats. Up to each individual to choose to install it or not, whining about it makes no sense as the great majority of players prefers to play against players that does not cheat.
Games as popular as those from riot games and with the ambition to be pillars of competitive gaming don’t really let the choice than enforcing anti cheat. (It would be like organizing Olympics and not testing the athletes for drugs, the competition would loose its meaning).
There are plenty of other games that do not enforce anti cheat so I am sure you can have some fun with these (if playing against cheaters suits you).
The design and implementation are both flawed. There’s no justification for a kernel‑level service running 24/7 instead of only when the game launches, and the quality problems speak for themselves. Just don't defend them, it's wrong!
I would recommend reading their dev blog.
It is really one of the best technically and they explain perfectly why it is always running from the moment you turn your PC on.
You should quit the “they are evil” childish temper and try more to understand “why would they ever do this?”. I do understand you are upset but trust me (and again, verify it by reading their technical explanation) you are wrong to attack blindly. It would be like being against vaccines because “omg it’s a needle piercing my skin, why would I ever let that happen, are these doctors crazy?”.
🤡