VAN 9003 Fix: Secure Boot and TPM 2.0 for Valorant

VAN 9003 means Vanguard can't verify your PC meets Riot's Windows 11 security baseline. You need Secure Boot and TPM 2.0 enabled in UEFI. Here's the exact fix.

You launched Valorant, Vanguard loaded, and then VAN 9003 popped up telling you your PC doesn't meet the minimum spec. Annoying, especially when you're on Windows 11 and everything else works fine.

Here's the actual fix, in order.

Check what Windows actually sees

Before you reboot into BIOS, confirm the two things Vanguard is complaining about. Open an elevated Command Prompt and run:

tpm.msc

You want to see "The TPM is ready for use" and a specification version of 2.0. If it says 1.2, or "TPM cannot be found," that's your problem.

Now check Secure Boot. Run:

msinfo32

Look at the System Summary pane. Find Secure Boot State. If it says "Off" or the field is missing entirely, you've got work to do. If BIOS Mode says "Legacy" instead of "UEFI," that's the root cause — Secure Boot only works in UEFI mode.

Enable TPM 2.0 and Secure Boot in UEFI

Reboot and hammer the BIOS key during POST. On most boards that's Del, F2, or F10. Once you're in:

Find the Security or Advanced tab. On ASUS it's usually under Advanced > PCH-FW Configuration or Boot. On MSI it's under Settings > Security. On Gigabyte it's under Settings > Miscellaneous.
Enable TPM. The label varies: Intel boards call it PTT (Platform Trust Technology). AMD boards call it fTPM (Firmware TPM) or AMD CPU fTPM. Turn it on.
Enable Secure Boot. If it's greyed out, you need to first switch the boot mode from Legacy/CSM to UEFI only. Disable CSM (Compatibility Support Module).
If Secure Boot shows as "Setup Mode," go into Key Management and select Restore Factory Keys or Install Default Secure Boot Keys. That flips it to User Mode, which is what Vanguard wants.
Save and exit (F10 on most boards).

Boot into Windows, run msinfo32 again, and confirm both fields. Then launch Valorant.

Why this actually works

The reason step 3 works is that Secure Boot isn't a Valorant feature — it's a firmware-level chain of trust. When your PC boots, UEFI checks the signature on every driver and bootloader against keys stored in firmware. If something's been tampered with at the kernel level, the boot fails. Vanguard uses that guarantee. It wants to know the OS it's running on hasn't been compromised before Vanguard even loads.

TPM 2.0 does something related but different. It's a dedicated chip (or a firmware-emulated one on newer CPUs) that stores cryptographic keys and measurements. Vanguard uses it as a hardware-backed identity anchor. A cheat that hooks the kernel can't easily fake what the TPM reports, because the TPM is physically separate from the OS.

Riot made both mandatory for Windows 11 players in early 2022, alongside the Windows 11 launch. On Windows 10 they're recommended. On Windows 11 they're required, because Windows 11 itself requires them for a clean install — so if you bypassed that with a registry hack during install, Vanguard notices and refuses to run.

If you installed Windows 11 using the LabConfig registry bypass to skip the TPM check, VAN 9003 is expected. You'll need to enable the hardware properly or reinstall.

Less common variations

TPM is enabled but Valorant still throws VAN 9003

Two things to check. First, run tpm.msc and look at the status message. If it says "The TPM is ready for use, but the ownership is not taken," you need to clear it: right-click the TPM entry and select Clear TPM. Windows will take ownership on next boot. Second, some motherboard vendors shipped buggy TPM firmware in 2022–2023. Check for a BIOS update — ASRock and Gigabyte both pushed fixes for fTPM stutter and detection issues.

Secure Boot is enabled but the state shows "Unsupported"

That means the OS is installed in Legacy mode even though the firmware supports UEFI. You can convert without reinstalling using mbr2gpt:

mbr2gpt /validate /allowFullOS
mbr2gpt /convert /allowFullOS

Then reboot into BIOS, disable CSM, enable Secure Boot, and you're set. Back up first. This rewrites the partition table.

Dual-boot with Linux breaks Secure Boot

If you enrolled your own keys via MokManager to boot a Linux distro, Vanguard may reject the setup because the key chain isn't Microsoft's. The workaround is to re-enable the factory keys from BIOS Key Management. Your Linux install will need to be re-signed or booted with shim.

VAN 9003 on a VM

Vanguard doesn't run in virtual machines, period. If you're testing in Hyper-V, VMware, or VirtualBox, that's the cause. No BIOS tweak fixes it.

Prevention

Don't disable Secure Boot for other software. Some older anti-cheat and disk tools ask you to turn it off temporarily — resist that, or re-enable it the moment you're done. Leaving it off is how people end up back here.

Keep your motherboard BIOS current. fTPM bugs were genuinely common on AMD's Ryzen 5000 and 7000 platforms through 2023. A BIOS from 2024 or later avoids most of them.

And if you reinstall Windows 11, let the installer's own compatibility check do its job. The registry bypass is tempting when you've got older hardware, but Vanguard is one of several programs that now checks whether the requirement was legitimately met. Games, DRM, and some enterprise VPNs all read the same signals.

Once Secure Boot says "On" and tpm.msc says 2.0, VAN 9003 stops appearing. If it comes back, something changed at the firmware level — usually a BIOS reset, a CMOS battery dying, or a Windows update that flipped the boot mode. Check msinfo32 first.