Valorant's Vanguard anti-cheat is in a league of its own. While most anti-cheat systems read your hardware IDs through Windows APIs — making them relatively straightforward to spoof — Vanguard loads at system boot, before Windows even fully initializes. This gives it access to raw hardware data that other anti-cheats never see, and it's why the vast majority of HWID spoofers fail miserably against Valorant hardware bans.
If you've been hardware banned in Valorant and tried a spoofer that didn't work, you're not alone. Most spoofers on the market were designed for EAC and BattlEye games, where OS-level interception is sufficient. Vanguard requires an entirely different approach. In this guide, we'll explain exactly how Vanguard fingerprints your hardware, why regular spoofers fail, what features a Valorant-compatible spoofer needs, and how to use one correctly.
Why Valorant Hardware Bans Are Different
To understand why Valorant is harder to spoof, you need to understand what makes Vanguard unique. Most anti-cheat systems — EAC, BattlEye, even Ricochet — operate as kernel-level drivers that load after Windows boots. They read hardware IDs through Windows APIs and device drivers. A kernel-level spoofer can intercept these API calls and return fake values before the anti-cheat sees them.
Vanguard doesn't play by those rules. Riot's Vanguard anti-cheat starts running the moment you turn on your computer — not when you launch Valorant, not when Windows finishes booting, but at system startup. It operates as a boot-level driver that initializes before most Windows components, giving it a view of your hardware that's almost impossible to intercept with standard spoofing techniques.
This boot-level access means Vanguard can read hardware identifiers directly from firmware and physical interfaces, bypassing any OS-level interception. It's the digital equivalent of checking someone's actual birth certificate versus checking the copy they handed you — Vanguard goes to the source.
How Vanguard Fingerprints Your Hardware
Vanguard's hardware fingerprinting goes far beyond what other anti-cheats check. Here's every identifier Vanguard examines:
Boot-Level Scanning
Because Vanguard loads before most Windows drivers initialize, it can read hardware data directly from firmware interfaces. It reads SMBIOS data, disk controller information, and network adapter details before any spoofing driver has a chance to load. If your spoofer loads after Vanguard (which most do), Vanguard has already captured your real hardware fingerprint.
TPM Module Checking
The Trusted Platform Module is a security chip present on all modern motherboards (and required for Windows 11). Each TPM has a unique serial number and endorsement key. Most spoofers completely ignore the TPM because games like Fortnite and Apex don't check it. Vanguard does. If your spoofer doesn't change your TPM serial, Vanguard has a persistent identifier that survives every other type of spoofing.
Extended Disk Scanning
Standard anti-cheats read disk serial numbers through Windows APIs. Vanguard goes deeper — it checks disk firmware signatures and controller-level identifiers that are separate from the serial number displayed in Windows. A spoofer that only changes the serial number returned by Windows APIs leaves the firmware-level identifiers intact, and Vanguard reads those instead.
Full MAC Address Correlation
Most anti-cheats check the MAC address of your active network adapter. Vanguard checks ALL network adapters — including disabled ones, virtual adapters, and adapters that aren't connected to any network. Many people have a Wi-Fi adapter they never use, or a virtual adapter from VPN software. If your spoofer only changes the active adapter's MAC, Vanguard still sees the real MACs on every other adapter.
GPU Subsystem ID
Beyond the standard GPU serial number, Vanguard checks the GPU subsystem ID — a deeper identifier that includes the GPU's vendor-specific subsystem vendor ID and subsystem device ID. These are burned into the GPU's VBIOS and are not changed by most spoofers, which only modify the serial number visible through standard Windows queries.
Why Regular Spoofers Don't Work for Valorant
Understanding Vanguard's fingerprinting methods explains exactly why most spoofers fail against it:
User-Mode Spoofers
User-mode spoofers modify hardware IDs at the application level — they change what Windows reports to programs. Vanguard doesn't read hardware IDs through Windows. It has direct boot-level access. User-mode spoofers are completely invisible to Vanguard; it doesn't even look at the values they change. Using a user-mode spoofer for Valorant is like locking your front door while the back door is wide open.
Basic Kernel Spoofers
Most kernel-level spoofers intercept Windows API calls for hardware data and return spoofed values. This works against EAC and BattlEye because those anti-cheats use the same APIs. Vanguard's boot-level scanning bypasses these API hooks entirely. Additionally, basic kernel spoofers miss TPM module spoofing, don't handle disabled network adapters, and don't change disk firmware-level identifiers — leaving multiple fingerprints for Vanguard to find.
What You Actually Need
Only a spoofer with early-boot or pre-boot driver loading can get ahead of Vanguard. The spoofer's driver must load before Vanguard's driver, intercept hardware reads at the lowest level, and cover every single identifier Vanguard checks — including TPM, firmware-level disk data, all network adapters, and GPU subsystem IDs.
What a Valorant Spoofer Needs
Here's the complete list of features a spoofer must have to work against Vanguard:
- Kernel-level operation (minimum) — this is the bare minimum. User-mode will never work.
- Pre-boot or early-boot driver loading — the spoofer driver must initialize before Vanguard. This typically means loading during the boot process, not after Windows has started.
- TPM module spoofing — must change or mask the TPM serial and endorsement key.
- Firmware-level disk serial changes — must modify disk identifiers at the controller level, not just the OS-reported serial number.
- ALL network adapters spoofed — every adapter, active or disabled, wired or wireless, physical or virtual, must have its MAC address changed.
- GPU subsystem ID spoofing — must modify the GPU subsystem vendor and device IDs, not just the standard serial.
If a spoofer is missing even one of these features, Vanguard has a persistent identifier to link your hardware to the banned profile. There's no "partial success" with Vanguard — it either sees you as a completely new machine or it doesn't.
Spoofer Requirements: Valorant vs Other Games
| Feature Required | Valorant (Vanguard) | Fortnite (EAC) | CoD (Ricochet) |
|---|---|---|---|
| Kernel-level driver | Required | Required | Required |
| Early-boot loading | Required | Not needed | Recommended |
| TPM spoofing | Required | Not needed | Recommended |
| Firmware-level disk IDs | Required | API-level OK | Recommended |
| All network adapters | Required | Active only OK | Recommended |
| GPU subsystem ID | Required | Not checked | Checked |
| SMBIOS spoofing | Required | Required | Required |
| MAC address spoofing | Required | Required | Required |
| Overall difficulty | Extreme | High | Very High |
As the table shows, Vanguard requires every spoofing capability available. Features that are optional or unnecessary for Fortnite become mandatory for Valorant. This is why spoofers that work perfectly for Fortnite and Apex can fail completely against Valorant.
Vanguard loads at system startup — not when you launch Valorant. You MUST close Vanguard completely (system tray icon > Exit Vanguard), run the spoofer, and then reboot your PC before launching Valorant. Spoofing while Vanguard is already running does absolutely nothing because Vanguard has already captured your real hardware fingerprint.
Step-by-Step: Using a Spoofer for Valorant
Because Vanguard's boot-level scanning creates a specific sequence requirement, you must follow these steps exactly. Doing them out of order will result in the spoofer failing.
- Close Vanguard completely. Look for the Vanguard icon in your system tray (bottom-right of your taskbar, near the clock). Right-click it and select "Exit Vanguard." This is critical — Vanguard must not be running when you spoof. If you don't see the icon, check if Vanguard is running in Task Manager under Services (look for "vgc").
- Run the spoofer as administrator. With Vanguard closed, right-click your spoofer executable and select "Run as administrator." Let it complete its full spoofing process — SMBIOS, disks, MAC addresses, TPM, GPU, and trace cleaning.
- Verify all IDs have changed. Use the spoofer's verification tool or check manually with Device Manager and command-line tools. Confirm that every hardware identifier shows a new, spoofed value. Do not skip this step.
- Reboot your PC. This is mandatory. When your PC restarts, Vanguard will load during boot and read your now-spoofed hardware identifiers. The spoofer's early-boot driver must also reinitialize to intercept Vanguard's hardware queries.
- Create a new Riot account. Do not log into your banned account. Create a completely new Riot account with a fresh email address, different from anything linked to your banned account. Use a different payment method if you plan to purchase anything.
- Launch Valorant. Vanguard will read your spoofed hardware IDs and see your PC as a completely new machine. Your new Riot account will have no association with the banned one.
If at any point Vanguard shows an error or requires a restart, close everything, re-run the spoofer, and reboot again. Vanguard occasionally updates its driver during restarts, which can interfere with the spoofing process on the first attempt.
Common Mistakes When Spoofing for Valorant
Even with a Vanguard-compatible spoofer, these mistakes will get you re-banned:
- Not closing Vanguard before spoofing — this is the most common mistake. If Vanguard is running, it's already captured your real IDs. Spoofing afterward changes nothing from Vanguard's perspective.
- Forgetting to reboot — the reboot is what causes Vanguard to re-read hardware IDs. Without it, Vanguard still has the real IDs from the previous boot cached in memory.
- Using the same Riot account — hardware spoofing changes your hardware identity, not your account identity. Logging into a banned account immediately re-links your hardware.
- Not cleaning traces first — Vanguard caches hardware data in local files and registry entries. If you don't clean these before spoofing, old cached IDs can re-identify you. Read our PC cleanup guide for the full process.
- Using a spoofer that doesn't support Vanguard — check your spoofer's feature list specifically for Vanguard compatibility. "Works with all games" claims are often false when it comes to Vanguard.
TATEWARE's HWID Spoofer includes full Vanguard compatibility — early-boot driver loading, TPM module spoofing, firmware-level disk serial changes, all network adapter coverage, and GPU subsystem ID spoofing. Every fingerprint Vanguard checks is covered.
What If You're Still Getting Banned?
If you're using a Vanguard-compatible spoofer and following the correct steps but still getting banned, check these things:
- IP address correlation — while not a hardware ban, connecting from the same IP address can flag your new account. Consider using a VPN for initial sessions.
- Behavioral detection — if you were banned for cheating (not just a linked hardware ban), Riot's behavioral analysis might flag similar gameplay patterns. This isn't hardware-related but can result in a new ban.
- Spoofer was detected — Vanguard occasionally detects specific spoofer drivers. Check your provider's status channel. If the spoofer was detected, stop using it until an update is released.
- Incomplete trace cleaning — Riot stores data in multiple locations. Make sure you've cleaned all Riot Games folders, Vanguard cache files, and related registry entries.
For a full troubleshooting guide covering all common spoofer issues, read our HWID spoofer not working: 10 common fixes guide.
Our Recommendation
For Valorant specifically, the TATEWARE HWID Spoofer is our recommendation. It's one of the few spoofers that covers every fingerprint Vanguard checks — including TPM and boot-level identifiers that most competitors miss. It includes automatic trace cleaning, handles all network adapters (including hidden and disabled ones), and provides verification that every component has been successfully spoofed before you launch the game.
For more information on HWID spoofing across all games, see our best universal HWID spoofer comparison. To understand the basics of hardware spoofing, read what is an HWID spoofer. And if you're wondering whether a VPN can help with hardware bans, check our HWID spoofer vs VPN explainer.
TATEWARE HWID Spoofer — Vanguard Compatible
Full Vanguard bypass. Early-boot loading. TPM spoofing. All network adapters. GPU subsystem IDs. Trace cleaning included.
View ProductsBottom Line
Valorant's Vanguard is the hardest anti-cheat to bypass, and most spoofers simply aren't built for it. Don't waste money on a generic spoofer that claims to work with "all games" but doesn't specifically address Vanguard's boot-level scanning, TPM checking, firmware-level disk reads, and full network adapter enumeration. You need a spoofer that was specifically designed and tested against Vanguard — anything less and you're throwing money away and risking further bans on your new account.