Key Takeaways
- Check Secure Boot: The VAN 9003 error in Valorant appears when Windows 11 reports Secure Boot as off, even if the BIOS shows it as enabled. Open msinfo32 to check BIOS Mode and Secure Boot State, then use tpm.msc to verify TPM 2.0.
- Fix the Boot Mode: To fix VAN 9003 in Valorant, back up your files and save your BitLocker recovery key before converting an MBR disk with MBR2GPT if needed. Switch to UEFI, disable CSM, and enable Secure Boot, then enable Intel PTT or AMD fTPM for VAN 9001.
- Recover and Retest: If enabling Secure Boot for Valorant stops Windows from starting, turn Secure Boot back off. For VAN STATUS_SB_POLICY, confirm that the factory keys trust Windows UEFI CA 2023 before restoring them, and contact Riot Support if Vanguard still blocks you.
Valorant won’t start, or you’re halfway through a match when Vanguard kicks you out with VAN 9003. The error means Windows reports Secure Boot as off. On Windows 11, Vanguard needs Secure Boot and TPM 2.0 active, so start by checking what Windows can see.
Most fixes happen in the BIOS, though an older Windows install may need its system disk converted from MBR to GPT first. If Secure Boot looks enabled in the BIOS while Windows says it’s off, check your boot mode and Secure Boot keys. If Windows stops starting after you enable Secure Boot, you’re dealing with a boot problem first. The exact code can help you decide where to start.
What the VAN 9003 Error Means
Vanguard checks your PC’s security features when you play Valorant. VAN 9003 points to Secure Boot, while a similar code can point to TPM 2.0 or a different check altogether. Start with the message on your screen.
The Message You See and Related Codes
The pop-up may show VAN9003 without a space and tell you to enable Secure Boot before you can play. VAN 9001 means Vanguard needs you to enable TPM 2.0. VAN 9090 means TPM 2.0 failed to initialize, which can happen after the TPM has been cleared.
VAN STATUS_SB_POLICY means Vanguard couldn’t verify your Secure Boot policy, even if Secure Boot is on. A VAN RESTRICTION message tells you that Vanguard wants a Windows update or a specific security feature before it’ll let you launch the game.
Why Windows 11 PCs Still Hit It
You’ve already installed Windows 11, so how can Secure Boot still be off? Windows 11 requires a PC that supports Secure Boot. Your PC can meet that requirement with Secure Boot switched off.
Vanguard checks whether Secure Boot is actually on. You can open Valorant on a PC that runs Windows 11 just fine and still get blocked at that check. That’s why your first stop is System Information, where you can see the state Windows reports.
What Causes VAN 9003
Sometimes all you need is one BIOS change. Other times, the way Windows boots or the keys your firmware uses can keep Secure Boot off even when the BIOS switch says it’s enabled. Here’s how to tell those cases apart.
Secure Boot Is Switched Off
If System Information shows UEFI next to BIOS Mode and Off next to Secure Boot State, start with the Secure Boot switch in your firmware. Your PC is already using the boot mode Secure Boot needs.
After you enable Secure Boot and save the change, boot into Windows and check System Information again. If it still says Off, the next clues are whether CSM is disabled and whether your firmware has Secure Boot keys installed.
Legacy BIOS Mode, CSM and an MBR Disk
Secure Boot needs UEFI. If Windows reports Legacy under BIOS Mode, check whether your Windows drive uses the older MBR partition style. Your firmware may also have the Compatibility Support Module, or CSM, enabled for Legacy boot.
The order matters here. If your Windows drive uses MBR, switching the firmware to UEFI first can leave Windows unable to start. Check the disk, convert it to GPT if needed, then make the firmware change.
Missing or Non-Default Secure Boot Keys
Ever seen Secure Boot set to Enabled in the BIOS while Windows still shows Off? Missing keys can explain that mismatch. The Secure Boot switch may even be greyed out if the keys haven’t been installed.
A different set of keys can also matter if Vanguard shows VAN STATUS_SB_POLICY. Before restoring factory keys, check whether your firmware’s defaults trust the Windows UEFI CA 2023 certificate. If your Windows boot manager already uses that signature, older factory keys can cause a Secure Boot Violation when you restart.
Outdated BIOS Firmware
If you’ve enabled Secure Boot and saved the change but Vanguard still blocks you, check whether your motherboard has a BIOS update. An older firmware version can be the reason you’re still stuck after getting the basic options right.
A firmware update is especially worth checking before you touch the Secure Boot keys. Newer firmware may include updated factory keys, but you’ll still want to confirm that your board’s defaults trust the 2023 certificate before you reset them.
Back Up and Save Your BitLocker Key First
If BitLocker protects your Windows drive, a firmware change can bring up the BitLocker recovery screen the next time you start your PC. Restoring Secure Boot keys can trigger that prompt, and switching TPM modes can clear TPM keys. Pull up your saved recovery key before you restart and keep a copy somewhere you can reach without signing into this PC.
Suspend BitLocker protection before changing TPM modes or restoring Secure Boot keys. Before following the MBR2GPT steps below, back up your files and turn off drive encryption. The tool is designed to keep your files in place, but the conversion can’t be undone.
There’s one more thing to check if you’re planning to restore factory keys. Microsoft warns that the reset can remove a certificate your PC already needs to start Windows. Once your files and recovery key are safe, start with the Windows checks below and make only the changes your PC needs.
How to Fix VAN 9003 in 12 Steps
You can skip the disk conversion if Windows already boots in UEFI mode from a GPT drive. The later steps cover what to do if Secure Boot stays off, Vanguard flags TPM 2.0, or you get a different code after a restart. Begin by checking the two lines in Windows that tell you where to go next.
1. Check BIOS Mode and Secure Boot State in System Information
Press Win + R, type msinfo32, and press Enter. In System Summary, find BIOS Mode and Secure Boot State.
If you see UEFI and On, Secure Boot is already active in Windows, so read the Vanguard message again for another requirement. If you see UEFI and Off, go to step 5. If BIOS Mode says Legacy and Secure Boot State shows Off or Unsupported, check your disk before you change anything in the firmware.
2. Check Whether Your Disk Uses MBR or GPT
Open Disk Management and find the disk that holds Windows. Right-click the disk itself, open Properties, and select the Volumes tab.
Look at Partition Style. If it says GPT, skip the conversion and move on to the UEFI check. If it says MBR and Windows is booting in Legacy mode, leave the boot mode alone until the disk has been converted.
3. Convert the System Disk to GPT With MBR2GPT
Use MBR2GPT on the Windows system disk after you’ve backed up your files and turned off drive encryption. Your PC needs to support UEFI, and you should have a 64-bit Windows install without dual boot. The disk can have up to three primary partitions and no extended or logical partitions. Keep Secure Boot off during the conversion.
Open Command Prompt as administrator and run mbr2gpt /validate /allowFullOS. If validation fails, stop there and leave the firmware in its current boot mode. If it succeeds, run mbr2gpt /convert /allowFullOS.
Once the conversion succeeds, restart directly into the firmware menu. Set the boot mode to UEFI before you try to start Windows from the converted drive.
4. Switch the Boot Mode to UEFI and Turn Off CSM
To open the firmware from Windows 11, go to Settings > System > Recovery and choose Restart now under Advanced startup. Then select Troubleshoot > Advanced options > UEFI Firmware Settings > Restart. You can also use your PC’s firmware key as it starts, often Del, F2, or F10.
Find Boot Mode and select UEFI. If your firmware has a CSM option, disable it. Save your changes, then return to the firmware if you still need to enable Secure Boot.
5. Turn On Secure Boot in the BIOS
Open the Boot tab and look for Secure Boot. If you can’t find it and your firmware offers a search, try searching for Secure Boot. Set it to Enabled, then save and exit, often with F10.
Once Windows loads, open msinfo32 again. You want BIOS Mode to show UEFI and Secure Boot State to show On. If the Secure Boot option was greyed out or Windows still says Off, check the keys before changing anything else.
6. Restore the Default Secure Boot Keys When the Option Is Greyed Out
If you just switched to UEFI and Secure Boot is still greyed out, save the change and reopen the firmware menu. Before restoring any keys, confirm that your firmware’s factory defaults trust the Windows UEFI CA 2023 certificate. If you can’t confirm that, go to step 7 for the firmware check and step 10 to see what Windows reports.
Once you’ve confirmed the factory keys are suitable and suspended BitLocker if you use it, look for Key Management under Boot or Security. Choose Install Default Secure Boot Keys if that’s the label your board uses, and confirm that the keys are installed. Enable Secure Boot, save, and check its state in Windows again.
7. Update Your Motherboard BIOS
In msinfo32, look up BaseBoard Manufacturer and BaseBoard Product. Use those details to find the latest BIOS for your exact board on the manufacturer’s site. Follow its instructions to prepare a FAT32 USB drive and run the update from the built-in firmware utility.
Keep the PC powered on while the update runs. Afterward, check BIOS Mode and Secure Boot State again in Windows. If you came here because the Secure Boot option was greyed out, confirm what certificates the updated factory keys trust before you return to step 6.
8. Turn On TPM 2.0 Through Intel PTT or AMD fTPM
Press Win + R, enter tpm.msc, and check whether the TPM is ready to use. Look for Specification Version 2.0. If Windows reports version 1.2 or can’t find a compatible TPM, check the firmware options.
On an Intel PC, look for Intel Platform Trust Technology or PTT. On AMD, look for AMD fTPM or TPM Device Selection and choose the firmware TPM option. The exact path depends on your board.
| Brand | Intel TPM path | AMD TPM path |
|---|---|---|
| ASUS | Advanced → PCH-FW Configuration → PTT | Advanced → AMD fTPM Configuration → AMD fTPM switch |
| MSI | Settings → Security → Trusted Computing → TPM Device Selection → PTT | Settings → Security → Trusted Computing → TPM Device Selection → AMD CPU fTPM |
| Gigabyte | Settings → Miscellaneous → Intel Platform Trust Technology | Settings → Miscellaneous → AMD CPU fTPM |
| ASRock | Security → Intel Platform Trust Technology | Advanced → CPU Configuration → AMD fTPM Switch → AMD CPU fTPM |
Suspend BitLocker before switching TPM modes, since the switch can clear TPM keys. Save the firmware change, restart, and open tpm.msc again to verify version 2.0. A separate TPM chip can satisfy VAN 9001, while a VAN RESTRICTION message that asks for TPM needs Intel PTT or AMD fTPM.
9. Fix VAN STATUS_SB_POLICY the Safe Way
If the message changes to VAN STATUS_SB_POLICY, Vanguard is having trouble verifying the Secure Boot policy. Riot’s fix is to restore the factory keys, even if Secure Boot already shows On. This is where the certificate check matters, since an older set of factory keys can leave Windows unable to boot.
Check for a firmware update and confirm that the factory keys trust Windows UEFI CA 2023 before following step 6. If the policy error continues after you restore compatible factory keys, send Riot Support a ticket with your Riot Repair Tool logs.
10. Check the Secure Boot Certificate Status in Windows Security
Open Windows Security > Device security > Secure Boot. A green check means the required certificate updates have been applied. A yellow notice can point to older certificates or a firmware limitation, while a red notice means you need to act on the message shown.
Install Windows updates if the app reports an older boot trust configuration. If an update refuses to finish, our guide to a stuck Windows 11 update can help. If it flags a hardware or firmware limitation, check with your PC or motherboard manufacturer. Use this screen as a precaution before changing keys. The certificate status alone can’t tell you what caused VAN 9003.
11. Set the vgc Service to Automatic and Reinstall Vanguard
If Secure Boot is on and you now see VAN 57 or VAN -81, check whether Vanguard’s service can start. If you use Vanguard without Pre-Check, press Win + R, type services.msc, and open vgc. Set Startup type to Automatic, select Start if the service is stopped, then choose Apply and OK before restarting.
If Vanguard still fails to start, close your Riot apps and uninstall Riot Vanguard through Add or remove programs. Launch the Riot Client or Valorant to install Vanguard again. If Windows still reports Secure Boot as Off, return to the firmware checks above.
12. Turn On Memory Integrity and IOMMU If Vanguard Asks
If Vanguard asks for Memory Integrity, open Windows Security > Device Security > Core isolation, turn on Memory integrity, and restart. If Windows flags a driver, open Review incompatible drivers and update or uninstall the driver it names.
Open msinfo32 and look for Virtualization-based security. You want it to say Running and list Hypervisor enforced Code Integrity among the running services. If virtualization is off in the BIOS, enable Intel Virtualization Technology and Execute Disable Bit on Intel, or SVM Mode and NX Mode on AMD.
If Vanguard asks for IOMMU, look for VT-d on Intel or IOMMU or AMD-Vi on AMD. Enable it in the BIOS, save your changes, and start Windows again. Kernel DMA Protection can still show Off in System Information because Vanguard checks the IOMMU option in the firmware.
If Windows Won’t Boot After You Turn On Secure Boot
You save the BIOS change, restart, and end up right back in the BIOS. Or maybe you get a BitLocker prompt or a Secure Boot Violation before Windows loads. What you see on that first restart tells you which fix to try.
Turn Secure Boot Back Off to Get Back In
If Windows stopped loading right after you enabled Secure Boot, reopen the BIOS and turn Secure Boot off. Save the change and restart. If you’ve already converted your Windows disk to GPT, keep the boot mode set to UEFI.
Once you’re back in Windows, open msinfo32 to check BIOS Mode and Secure Boot State. If the PC boots in UEFI mode with Secure Boot off, check for a firmware update before trying again. If the trouble started after you restored the factory keys, check which certificates those keys trust.
Getting Past the BitLocker Recovery Screen
If Windows asks for your BitLocker recovery key, enter the key you saved before making the BIOS changes. Once Windows loads, make sure you can still get to that saved copy before going back into the firmware.
If you don’t have the key handy, pause and find it before making more changes. Once you’re back in Windows, suspend BitLocker before restoring Secure Boot keys or switching TPM modes again. A firmware change can bring the recovery prompt back on your next restart.
A Secure Boot Violation After Resetting Keys
Did the warning appear right after you restored the factory keys? Your firmware may have lost the certificate it needs to trust your Windows boot manager. If the boot manager already uses the Windows UEFI CA 2023 signature, older factory keys can block it from loading.
Turning off Secure Boot may get you back into Windows. Microsoft also provides a recovery utility that you can copy to a FAT32 USB drive from another PC that has a July 2024 or later update. The utility adds the missing 2023 certificate, after which you can apply the newest certificates again and then update the firmware.
Other Vanguard Errors You Might See Next
You’ve checked System Information, and Secure Boot finally says On. Then Valorant shows you a different code. Read the new message before going back into the BIOS, since it can point to anything from TPM 2.0 to a driver.
VAN 9001 and VAN 9090
VAN 9001 means Vanguard needs you to enable TPM 2.0. Open tpm.msc and check that the TPM is ready and that Specification Version reads 2.0. If Windows can’t find a compatible TPM, check for Intel PTT or AMD fTPM in the BIOS.
VAN 9090 means TPM 2.0 failed to start up, which can happen after it’s been cleared. Check that TPM 2.0 is enabled, restart your PC, and open Valorant again.
VAN RESTRICTION 1, 3, 4 and 5
VAN RESTRICTION 1 means Vanguard couldn’t verify Secure Boot in UEFI mode. Check that Windows is using UEFI and that Secure Boot is on, then check for a BIOS update if the error persists. VAN RESTRICTION 4 also points to Secure Boot, so go back through the boot mode, Secure Boot, and key checks.
VAN RESTRICTION 3 points to where you installed Valorant. Reinstall it on the same drive as Windows if it’s on a separate drive. For VAN RESTRICTION 5, turn on Memory Integrity and use msinfo32 to confirm it’s running after you restart.
VAN 57 and VAN -81
VAN 57 can appear when Vanguard fails to start. If you don’t use Pre-Check, open services.msc, set vgc to Automatic, and restart your PC. If the service still won’t start, reinstall Riot Vanguard.
VAN -81 can mean Vanguard is having trouble starting, staying connected, or confirming it’s ready. Try a restart, then check the date, time, and time zone in Windows. If those are right and the error comes back, check vgc and reinstall Vanguard if needed.
Incompatible Driver Errors and VAN 9101
If Vanguard flags incompatible software, read the file path in the alert. It can help you identify which program to uninstall. If Windows flags a driver while you’re turning on Memory Integrity, open Review incompatible drivers under Core isolation and update or uninstall the driver it names.
With VAN 9101, Vanguard couldn’t verify that it can trust your PC. Check for Windows updates, update your graphics, chipset, and storage drivers, and unplug USB devices you don’t need. When you’re ready to test again, try the Practice Tool or a custom game before you queue for a match.
Get Back Into Your Matches
Start with what Windows can see. If System Information shows UEFI and Secure Boot On, check TPM 2.0 and read any new Vanguard message before changing the BIOS again. That next code may point you to a fix you can make right from Windows.
Once Valorant opens, try the Practice Tool or a custom game before you get back into matchmaking. If you’re still blocked after following the steps for your code, contact Riot Support. Include the exact message you see so they know which check is still failing. And if another launcher acts up after these changes, our guides on Steam not opening and Battlefield 6 crashing on PC cover those problems.
FAQs
You can still get VAN 9003 if the BIOS says Secure Boot is enabled while Windows reports it as off. Open msinfo32 and check Secure Boot State and BIOS Mode. If Windows says Off, check whether you’re using UEFI and whether the Secure Boot keys are installed. If Windows says On, reread the Vanguard message to see whether it’s flagging a different requirement.
MBR2GPT is designed to convert your Windows system disk while keeping your files in place. Back them up first because you can’t undo the conversion. Run the validation command before you convert the disk. Once the conversion succeeds, switch the firmware to UEFI before trying to start Windows again.
A VAN RESTRICTION message means Vanguard wants a Windows update or a security feature before it’ll let you play. You can see the message on one account even if another account works on the same PC. Read the full alert to see what Vanguard asks you to change. If it names Secure Boot, TPM 2.0, Memory Integrity, or IOMMU, check that feature first.
You may need to upgrade to Windows 11 to keep playing Valorant. Riot’s restriction guidance tells Windows 10 users to upgrade, while the same guidance lists build 19045 as a minimum. The guidance leaves the cutoff for Windows 10 players unclear. If your Vanguard message specifically asks for Windows 11, you’ll need to meet that requirement to get past the restriction.
You need Windows 11 25H2 or newer to use Vanguard Pre-Check, which is optional for playing Valorant. Pre-Check lets Vanguard start when you launch a Riot game and stop when you’re done. If you’re troubleshooting VAN 9003, check Secure Boot in Windows first. If you want to use Pre-Check, the Vanguard tray icon can show you which requirements you still need to meet.
Yes, you can generally leave Secure Boot on for your other games if Windows starts normally with it enabled. Secure Boot runs its checks when your PC starts, so switching games doesn’t require you to change it. If your PC shows a Secure Boot Violation before Windows loads, check the firmware and certificate issue first. Once Windows boots normally again with Secure Boot on, you can test your games from there.
