Valorant UEFI Secure Boot: How to Check, Enable, and Fix It

Valorant won't launch if your PC isn't in UEFI mode with Secure Boot enabled. Vanguard, Riot's anti-cheat software, checks both before the game opens. If you just saw a Vanguard error pop-up, your system either has Secure Boot turned off, is still running in Legacy BIOS mode, or has a drive partition that needs converting first. Here's how to fix each of those scenarios.

Why Valorant Requires UEFI and Secure Boot

Secure Boot is a firmware-level security feature that controls what software is allowed to run during your PC's startup process. Only code that's been cryptographically signed and trusted gets through. Anything unsigned — including certain cheat tools — gets blocked before Windows even loads.

UEFI (Unified Extensible Firmware Interface) is the modern boot protocol that makes Secure Boot possible, as outlined in the UEFI specification on Wikipedia. Legacy BIOS, the older alternative, doesn't support it. So if your system is still running in Legacy mode, Secure Boot simply can't be turned on — regardless of what your other settings say.

Vanguard enforces both because they give it confidence that the system hasn't been tampered with at a low level. In practice, most cheat software that bypasses game-level detection tries to operate before Windows loads — exactly the window that Secure Boot closes.

If Secure Boot or UEFI mode is off, you'll typically see VAN9001 or VAN9003 when you try to launch Valorant. VAN9001 usually points to a Secure Boot issue; VAN9003 typically indicates TPM 2.0 is missing or disabled.

Vanguard's Full Security Requirements

Secure Boot and UEFI aren't the only things Vanguard checks. According to Ars Technica's reporting on Riot's anti-cheat requirements, Riot has steadily expanded its security stack beyond just Secure Boot — and players who only fix one setting often get blocked by another.

Here's the complete picture:

What's often overlooked is that you may pass the Secure Boot check and still get blocked — because TPM 2.0 is off, or Memory Integrity is flagging a driver conflict. Check all of these, not just Secure Boot.

Step 1 — Check Your Current Status

Before changing anything, find out exactly what state your system is in.

How to Check BIOS Mode and Secure Boot

Press Windows Key + R, type msinfo32, and hit Enter. In the System Information window, look for two fields:

• BIOS Mode
• Secure Boot State

Here's what your results mean:

How to Check TPM 2.0 Status

Press Windows Key, type tpm.msc, and hit Enter. If the status reads "The TPM is ready for use" and the spec version shows 2.0, you're fine. If it says a compatible TPM cannot be found, you'll need to enable it in BIOS (covered in Step 4).

Step 2 — Convert Your Drive from MBR to GPT (Legacy Users Only)

If your BIOS Mode shows Legacy, don't jump straight into BIOS and start changing things. That's a common mistake — and it can leave Windows unable to boot.

The correct order is: convert your drive first, then switch to UEFI, then enable Secure Boot. Reversing this sequence is what causes problems.

Why This Matters

Legacy BIOS systems use MBR (Master Boot Record) as their partition format. UEFI requires GPT (GUID Partition Table). You need to convert the drive before your system can run in UEFI mode at all.

Before You Convert — Check These First

Also — back up your files before running this. The conversion process is generally safe and doesn't delete data, but it can't be undone once complete.

How to Run the Conversion

1. Press Windows Key, type cmd, right-click Command Prompt, select Run as administrator
2. Type: mbr2gpt /validate /allowFullOS — press Enter
3. If validation passes, type: mbr2gpt /convert /allowFullOS — press Enter
4. Do not reboot into Windows yet. Go directly to Step 3.

Step 3 — Enable Secure Boot in BIOS

How to Access BIOS

Windows 11: Start → Settings → System → Recovery → Advanced startup → Restart Now

Windows 10: Start → Settings → Update & Security → Recovery → Advanced startup → Restart Now

After restarting, go to: Troubleshoot → Advanced options → UEFI Firmware Settings.

Alternatively, restart your PC and press Del, F2, or F10 immediately — before Windows loads. The exact key varies by manufacturer.

Disable CSM First

Before you can enable Secure Boot, look for an option called CSM (Compatibility Support Module) and turn it off. CSM is a legacy compatibility layer that directly conflicts with Secure Boot. If it's still on, the Secure Boot option will often be grayed out or unavailable.

This is one of the most commonly missed steps — and the reason a lot of users get stuck at a grayed-out Secure Boot toggle.

Enable Secure Boot

Navigate to the Boot tab (sometimes under Security depending on your motherboard brand). Find Secure Boot or Secure Boot State and set it to Enabled.

If you just converted from MBR to GPT, also find Boot Mode and switch it from Legacy/CSM to UEFI at this point.

Press F10 (or your BIOS's Save & Exit option) to save changes and restart.

Step 4 — Enable TPM 2.0 in BIOS (If Not Already Active)

TPM 2.0 settings look different depending on whether you're on an AMD or Intel system — they use different names for the same feature.

AMD Systems

Look for AMD fTPM or AMD CPU fTPM under the Security or Advanced tab. Set it to Enabled.

Intel Systems

Look for Intel PTT (Platform Trust Technology) under the Security or Advanced tab. Set it to Enabled.

After saving and rebooting, run tpm.msc again to confirm the spec version reads 2.0.

Valorant UEFI Secure Boot — Confirm Everything Is Active

Once back in Windows, run msinfo32 one more time. You want to see:

• BIOS Mode: UEFI
• Secure Boot State: On

Then run tpm.msc and confirm: The TPM is ready for use / Specification Version: 2.0

If both checks pass, relaunch Valorant. Vanguard should start without errors.

Troubleshooting — When It Still Doesn't Work

Secure Boot Is Grayed Out in BIOS

Three likely causes: CSM is still enabled, you're not in an admin-level BIOS session, or your BIOS firmware needs updating. Disable CSM first — that fixes it in most cases.

Secure Boot Is On But Vanguard Still Errors

Try resetting your Secure Boot keys to factory defaults. This option is usually found in the same BIOS menu as the Secure Boot toggle, labeled Restore Factory Keys or Reset to Setup Mode. Corrupted or custom keys can cause Vanguard to reject an otherwise valid Secure Boot state.

VAN9001 or VAN9003 Persists After Enabling Everything

Restart your PC fully — not just a fast boot. Windows Fast Startup can skip the firmware handshake. Also check the Vanguard system tray icon (VGTray) for a specific message — it will point to whichever requirement is still unmet.

My PC Doesn't Support UEFI or TPM 2.0

Older hardware — generally anything pre-2013 — may not support UEFI or TPM 2.0 at all. If your motherboard has no UEFI option and no TPM header, there's no software fix for this. Valorant's system requirements genuinely exclude those machines. Upgrading the motherboard (and likely the CPU) is the only path forward.

Conclusion

To run Valorant, your PC needs UEFI mode, Secure Boot enabled, and TPM 2.0 active. If you're on Legacy BIOS, convert your drive to GPT first — then switch modes. Most issues come down to CSM still being on or steps done out of order.

Frequently Asked Questions

Will enabling Secure Boot affect my other games or software?

In most cases, no. Secure Boot only affects what runs during startup. Once Windows loads, your existing software and games are unaffected. Rarely, unsigned drivers may stop working — but this is uncommon on standard gaming setups.

Does this apply to Windows 10 or only Windows 11?

Both. Vanguard enforces Secure Boot and TPM 2.0 on Windows 10 and Windows 11. The steps to check and enable these settings are the same on both versions.

Can I reverse the MBR to GPT conversion?

No. The mbr2gpt conversion is one-way and cannot be undone through normal means. Back up your files before running it. Your data is preserved during conversion, but the partition format change is permanent.

What is CSM and why does it block Secure Boot?

CSM (Compatibility Support Module) is a legacy layer that lets modern UEFI firmware behave like old BIOS. It conflicts with Secure Boot by design. Disabling CSM is required before Secure Boot can be enabled on most motherboards.

What's the difference between AMD fTPM and Intel PTT?

They do the same job — both are firmware-based TPM 2.0 implementations built into the processor. AMD calls it fTPM; Intel calls it PTT. Neither requires a separate hardware chip. Both are enabled through BIOS under the Security or Advanced tab.