How to Fix VALORANT TPM 2.0 and Secure Boot Errors

If VALORANT shows VAN9001, VAN9003, or a VAN:Restriction message about TPM 2.0, Secure Boot, UEFI, or firmware, the dependable fix is to correct those settings in your PC’s UEFI/BIOS and then verify that Windows reports them correctly. Reinstalling VALORANT usually cannot repair a disabled firmware feature. Check TPM with tpm.msc and check BIOS mode and Secure Boot with msinfo32 first. If Windows is installed in Legacy mode on an MBR disk, do not switch blindly to UEFI: convert the disk safely or you may leave Windows unable to boot.

TPM 2.0 and Secure Boot are separate checks. A computer can have one enabled and still fail Vanguard’s requirement for the other.

What does the VALORANT Vanguard error mean?

Vanguard reports the security state that Windows and the system firmware expose. The code narrows the likely cause, but it does not prove that every machine needs the same repair.

Message or code	Likely issue	What to check
VAN9001	TPM 2.0 is disabled, unavailable, or not detected correctly.	Use tpm.msc, then enable the platform’s firmware TPM.
VAN9003	Secure Boot is disabled, or Windows is booted in a configuration Vanguard does not accept.	Use msinfo32; confirm UEFI mode, GPT compatibility, and Secure Boot.
“This build/version of Vanguard requires TPM 2.0 and Secure Boot”	One or both required states are missing.	Complete both verification paths below.
VAN:Restriction	Vanguard has applied a system-security restriction. The prompt can identify the missing control or firmware condition.	Follow the listed requirements and check for a motherboard firmware update.
Secure Boot is enabled in firmware but Off in Windows	CSM/Legacy may still be active, keys may be absent, the wrong boot entry may be selected, or the change may not have been saved.	Trust the Windows result from msinfo32, not only the BIOS screen.

Riot’s December 18, 2025 security update expanded Vanguard checks for pre-boot protections. Some VAN:Restriction cases involve a motherboard firmware flaw or additional protections such as IOMMU, rather than a simple missing toggle. A restriction is not by itself an accusation of cheating; it means Vanguard cannot accept the system’s security state. See Riot’s explanation at Riot’s Vanguard security update.

How do I check whether TPM 2.0 is enabled in Windows?

Use the TPM Management Console first. It shows whether Windows can communicate with a TPM and which specification it implements.

Method 1: TPM Management Console

1. Press Windows key + R.
2. Enter tpm.msc and press Enter.
3. Read Status and Specification Version.

A passing result says “The TPM is ready for use” and shows Specification Version: 2.0. Microsoft documents this check and the expected wording in its TPM 2.0 guidance.

• Compatible TPM cannot be found: TPM may be disabled in UEFI/BIOS, hidden by firmware, unsupported by the platform, or affected by an outdated BIOS.
• Specification Version 1.2: The installed TPM does not satisfy a 2.0 requirement.
• The console will not open: Check Windows Security and the PC or motherboard manufacturer’s support documentation before changing firmware settings.

Method 2: Windows Security

1. Open Windows Security.
2. Select Device security.
3. Open Security processor details.
4. Confirm that Specification version is 2.0.

If there is no Security processor section, Windows may not see a TPM. Microsoft’s Device security troubleshooting explains the related Windows Security screens.

How do I check Secure Boot and UEFI mode?

1. Press Windows key + R.
2. Enter msinfo32 and press Enter.
3. In System Summary, find BIOS Mode and Secure Boot State.

The target values are:

BIOS Mode: UEFI
Secure Boot State: On

• UEFI + On: Windows reports the normal Secure Boot configuration; investigate another requirement named by Vanguard.
• UEFI + Off: Secure Boot still needs to be enabled or its key database repaired.
• Legacy: Do not simply enable Secure Boot or switch modes. Inspect the system disk’s partition style first.
• Unsupported: The firmware may not support Secure Boot, CSM/Legacy may be active, or a firmware update may be required.

Secure Boot is a UEFI firmware feature. Microsoft explains why Legacy/CSM generally must be replaced by UEFI and how to reach the relevant settings in its Secure Boot guidance.

How do I enter UEFI/BIOS without guessing the startup key?

On Windows 11, use the recovery menu so you do not have to time a key press:

1. Open Settings > System > Recovery.
2. Beside Advanced startup, select Restart now.
3. Choose Troubleshoot > Advanced options > UEFI Firmware Settings.
4. Select Restart.

Some computers instead use Delete, F2, F10, or another key during power-on. The correct key depends on the exact laptop, motherboard, and firmware version, so use the manufacturer’s manual when the Windows route is unavailable.

How do I enable TPM 2.0 in UEFI/BIOS?

Recent processors commonly provide TPM as firmware built into the platform. The option is not always labeled “TPM,” and menu paths differ substantially between desktop boards and laptops.

AMD systems

Look for AMD fTPM, AMD PSP fTPM, Firmware TPM, TPM Device, or Security Device Support. A menu may appear under Advanced, Security, Trusted Computing, or Advanced > AMD fTPM configuration.

Intel systems

Look for Intel PTT, Intel Platform Trust Technology, TPM Device, or Security Device Support. The setting can be under Security, Trusted Computing, or an equivalent security submenu.

1. Set the matching firmware-TPM or security-device option to Enabled.
2. Save changes and restart.
3. Run tpm.msc again and confirm that the TPM is ready and version 2.0.

Microsoft lists these AMD and Intel labels in its TPM 2.0 instructions. Do not buy an add-on TPM before checking the exact PC or motherboard model. A physical module must match the board’s header, firmware, and security implementation; a random module may not work.

How do I enable Secure Boot safely?

Secure Boot depends on more than one switch. Windows must start through UEFI, CSM or Legacy support must be disabled, and the firmware must have valid Secure Boot keys.

1. Enter UEFI/BIOS.
2. Locate Boot, Security, or the firmware’s Secure Boot page.
3. Disable Legacy Boot, CSM, Launch CSM, or Legacy Support, if present.
4. Set boot mode to UEFI. If the firmware has an OS Type option, choose the Windows/UEFI setting.
5. Set Secure Boot or Secure Boot Control to Enabled.
6. If the key-management page says keys are missing, use Install default Secure Boot keys or Restore factory keys only when the firmware offers that standard option.
7. Make Windows Boot Manager the first boot option.
8. Save changes, restart, and check msinfo32.

Names such as CSM, Launch CSM, OS Type, Secure Boot Control, and key-management commands vary by manufacturer and model. Do not copy a menu path from a different board or laptop. If Windows reports Secure Boot Off after the restart, the firmware may still be using a legacy entry, the change may not have been saved, or the key database may be incomplete.

What if BIOS Mode says Legacy?

Legacy mode is the point where an otherwise simple toggle can make Windows unbootable. A Legacy installation commonly uses an MBR system disk, while UEFI Secure Boot normally requires a GPT disk.

Check the partition style before changing boot mode

In Windows, open Disk Management, right-click the disk containing the Windows partition, choose Properties, open Volumes, and read Partition style. You can also use an elevated terminal and diskpart to inspect the disk, but do not run conversion commands until you have identified the correct system disk.

• GPT: The disk is suitable for a UEFI transition; you still need to select the correct Windows Boot Manager entry.
• MBR: Convert the qualifying Windows disk before switching permanently to UEFI.

Use Microsoft’s MBR2GPT process

Microsoft’s MBR2GPT.exe utility is designed to convert a qualifying system disk without deleting its data, but it has prerequisites and limitations. Make a current backup, save your BitLocker recovery key, and suspend BitLocker protection before changing partitions or firmware. Read the complete Microsoft MBR2GPT documentation for your Windows configuration.

From an elevated Command Prompt, validate first:

mbr2gpt /validate /allowFullOS

Only if validation succeeds and you have reviewed the documented prerequisites, run:

mbr2gpt /convert /allowFullOS

After conversion, restart into firmware, change boot mode to UEFI, select Windows Boot Manager, and then configure Secure Boot. Do not run the conversion against a secondary data disk or skip validation.

How do I verify that the fix worked?

Verification must happen after Windows has booted, because Vanguard evaluates the state Windows receives from firmware.

1. Run tpm.msc. Confirm TPM is ready for use and Specification Version: 2.0.
2. Run msinfo32. Confirm BIOS Mode: UEFI and Secure Boot State: On.
3. Fully restart the PC, then launch VALORANT. A full restart reloads firmware and Vanguard state; closing only the game may not do so.

If either Windows result is different, return to the corresponding firmware section rather than reinstalling the game.

What if TPM and Secure Boot are enabled but VALORANT still fails?

When both Windows checks pass, the remaining issue may be stale software, outdated firmware, or a newer Vanguard restriction. Work through these steps in order:

1. Read the current Vanguard prompt again. It may name motherboard firmware, IOMMU, pre-boot DMA protection, or another control instead of TPM or Secure Boot.
2. Install pending Windows updates and restart.
3. Check the exact motherboard or laptop manufacturer page for a BIOS/UEFI update matching the model and hardware revision. Never flash firmware from a similar-looking model.
4. Update chipset drivers from the same manufacturer’s support page.
5. After recording your current firmware settings, apply the update and recheck TPM and Secure Boot. A BIOS update can reset fTPM/PTT, Secure Boot, boot order, XMP/EXPO, virtualization, fan curves, and other custom settings.
6. Reinstall Riot Vanguard only after the firmware state is correct. Reinstall VALORANT itself is a later step, not a substitute for firmware configuration.
7. If the restriction remains, contact Riot Support through its Vanguard Restrictions support page.

Include the exact code, a screenshot, your motherboard or laptop model, CPU model, Windows version and build, BIOS version, and the results from tpm.msc and msinfo32. Riot’s motherboard-security update describes cases where firmware correction is required even when a setting appears enabled.

What should I do if Windows will not boot after the change?

Do not keep changing unrelated firmware options. Use this recovery sequence:

1. Return to UEFI/BIOS.
2. Check whether Windows Boot Manager is present and first in the boot order.
3. If necessary, temporarily restore the previous boot mode so Windows can start while you investigate the disk format.
4. Confirm that the Windows disk is GPT before insisting on UEFI-only mode.
5. If Secure Boot keys were modified, restore the manufacturer’s default keys through the standard key-management option.
6. If BitLocker requests a recovery key, enter the saved key. Do not clear the TPM to bypass the prompt.

If the computer remains unbootable, follow the PC or motherboard manufacturer’s recovery procedure. Clearing the TPM can affect BitLocker, Windows Hello, and other credentials; it is not the normal way to re-enable TPM detection.

Which fixes should I avoid?

• Do not switch Legacy to UEFI blindly. Check MBR or GPT first.
• Do not clear the TPM as routine troubleshooting. Protect recovery keys and stored credentials instead.
• Do not flash an incompatible BIOS. Match the exact model and hardware revision.
• Do not use registry hacks, compatibility mode, administrator mode, or unofficial Vanguard bypasses. They cannot create a missing firmware security state and may weaken system security.
• Do not assume reinstalling VALORANT changes BIOS settings. Reinstallation can repair damaged files, not firmware configuration.
• Do not treat a BIOS screen as final proof. The Windows reports from tpm.msc and msinfo32 are the checks that matter for launch troubleshooting.

What if the PC cannot support TPM 2.0 or Secure Boot?

If the platform genuinely lacks TPM 2.0, UEFI Secure Boot support, or a firmware update that satisfies Vanguard, there is no responsible software bypass. The practical solution is a supported motherboard and CPU platform or another supported gaming PC. An add-on TPM is only an option when the exact motherboard manual and firmware support that module.

Windows 10 reached end of normal Microsoft support on October 14, 2025. That date does not explain every Vanguard error, but it matters when deciding whether to keep troubleshooting an older installation or move to a supported Windows release. Microsoft’s TPM guidance includes the support-lifecycle context at its TPM 2.0 page.

If your only message concerns a Secure Boot policy or certificate rather than VAN9001 or VAN9003, check Microsoft’s certificate-transition information. Certificates issued in 2011 begin expiring in June 2026, and supported Windows systems receive the relevant updates automatically; this is a separate issue from simply turning Secure Boot on.

Frequently Asked Questions

Can I play VALORANT without TPM 2.0 by disabling Vanguard?

No. Vanguard’s firmware checks are enforced at launch, and disabling or bypassing the service is not a supported solution. If the hardware cannot provide TPM 2.0, use a supported platform instead of weakening Windows security.

Will enabling Secure Boot delete my games or personal files?

Enabling Secure Boot alone does not erase files, but changing a Legacy/MBR installation to UEFI can prevent Windows from starting if done incorrectly. Back up important data and follow the MBR2GPT validation process before changing boot mode.

Why did a BIOS update make my VALORANT error return?

Firmware updates often reset fTPM/PTT, Secure Boot, key databases, or boot order to defaults. Recheck tpm.msc and msinfo32 after the update, then restore only the settings required by your model.

Could a Secure Boot certificate warning be unrelated to VAN9003?

Yes. A certificate-expiration or Secure Boot policy message is distinct from the usual disabled-setting error. Microsoft says 2011 Secure Boot certificates begin expiring in June 2026, with updates handled separately on supported Windows systems.