Detailed analysis
VAN 9001 means Riot Vanguard will not let you play Valorant until Secure Boot is enabled in your BIOS. The fastest fix: restart, enter BIOS, enable Secure Boot, disable CSM, save and reboot. If Windows still boots fine, you are done — launch Valorant. If Windows will not boot after that change, you have a deeper issue (Legacy/MBR install) and this guide covers that too.
Why Valorant needs Secure Boot
Vanguard is Riot's kernel-level anti-cheat. It loads before Windows even finishes booting so it can watch for cheats that try to hook into the OS at the deepest level. Secure Boot is a UEFI feature that verifies every piece of software that loads during boot is signed and trusted. Vanguard relies on this chain of trust — if Secure Boot is off, a cheat could load an unsigned driver before Vanguard starts and hide from it entirely. Riot made this mandatory for Windows 11 players in mid-2024. Windows 10 players are currently exempt, but that will likely change.
How to enable Secure Boot (step by step for each motherboard brand)
First, restart your PC and get into BIOS. The key you press during the boot splash screen varies by brand:
- ASUS: press Delete or F2
- MSI: press Delete
- Gigabyte: press Delete or F2
- ASRock: press Delete or F2
- Lenovo/HP/Dell prebuilt: press F2, F10, or F12 (check the splash screen text)
You have about 2 seconds to hit the key after powering on. If you miss it, restart and try again. If your PC boots too fast to catch it, you can also get there from Windows: open Settings > System > Recovery > Advanced startup > Restart now. Then go Troubleshoot > Advanced Options > UEFI Firmware Settings > Restart.
Once in BIOS, you need to do two things: disable CSM and enable Secure Boot. The order matters — on most boards, the Secure Boot option is greyed out until CSM is off.
ASUS boards: Boot tab > set Launch CSM to Disabled. Then Security or Boot tab > set Secure Boot to Enabled (or OS Type to Windows UEFI). Press F10 to save.
MSI boards: Settings > Advanced > Windows OS Configuration > set WHQL Support to Enabled (MSI's name for Secure Boot). Then set CSM/UEFI to UEFI under Boot. Press F10.
Gigabyte boards: Boot tab > set CSM Support to Disabled. Then Boot > Secure Boot > Enabled. On some Gigabyte boards, the Secure Boot option only appears after you disable CSM, save, and re-enter BIOS. Press F10.
ASRock boards: Security tab > Secure Boot > Enabled. Boot tab > CSM > Disabled. Press F10.
While in BIOS, also enable TPM 2.0 — Vanguard requires this too. Intel calls it PTT (Platform Trust Technology), usually under Security or Trusted Computing. AMD calls it fTPM, usually under Security or AMD CBS > PSP.
The CSM trap — why you cannot just flip Secure Boot on
CSM stands for Compatibility Support Module. It is a legacy BIOS emulation mode that lets modern UEFI motherboards boot old operating systems that do not understand UEFI. When CSM is enabled, your motherboard is pretending to be an old-school BIOS, and Secure Boot cannot work in that mode. They are mutually exclusive.
Here is the problem: if you installed Windows with CSM enabled (which many people did, especially on older builds or when following outdated guides), your hard drive uses the MBR partition scheme instead of GPT. When you disable CSM and the board switches to pure UEFI mode, it will not find your Windows installation because UEFI requires GPT. Your PC will boot straight to BIOS or show "No bootable device."
If Windows will not boot after disabling CSM — MBR to GPT conversion
Do not panic. Your data is still there. You need to convert your drive from MBR to GPT. Microsoft built a tool for this.
Option 1 (from within Windows before you change BIOS settings): Open Command Prompt as Administrator. Run: mbr2gpt /validate /disk:0. If it says "Validation completed successfully," run: mbr2gpt /convert /disk:0 /allowfullos. Once it finishes, reboot into BIOS, disable CSM, enable Secure Boot, save and exit. Windows should boot normally.
Option 2 (if you already disabled CSM and cannot boot): You need a Windows installation USB. Create one on another PC using the Media Creation Tool from Microsoft. Boot from the USB, click Repair your computer > Troubleshoot > Command Prompt. Run: mbr2gpt /convert /disk:0. Close the command prompt, reboot, and remove the USB. Windows should boot in UEFI mode now.
Option 3 (the nuclear option): If mbr2gpt fails, you can back up your files, clean install Windows in UEFI mode with GPT, and restore your data. This is slower but guarantees a clean setup.
Verifying everything is correct after the change
Once Windows boots, verify your settings:
- Press Win+R, type msinfo32, hit Enter. Look at BIOS Mode — it should say UEFI (not Legacy). Look at Secure Boot State — it should say On.
- Press Win+R, type tpm.msc, hit Enter. It should say "The TPM is ready for use" with Specification Version 2.0.
If both check out, launch Valorant. VAN 9001 should be gone.
What about dual-boot Linux?
Most modern Linux distros (Ubuntu 20.04+, Fedora, Pop!_OS, Mint 21+) support Secure Boot out of the box using a signed shim bootloader. You can usually re-enable Secure Boot and Linux still boots fine. The exception: unsigned kernel modules (like custom NVIDIA drivers on some distros) get blocked. You need to sign those modules with mokutil. Search "sign NVIDIA driver Secure Boot" plus your distro name for instructions.
If your distro does not support Secure Boot at all, your options are: switch distros, use a VM for Linux, or keep a separate drive and toggle Secure Boot when switching. Riot is not budging on this requirement.
Frequently asked questions
Q: I enabled Secure Boot but still get VAN
9001. What else is wrong?
A: Check three things. First, make sure CSM is actually disabled — some boards have CSM and Secure Boot as separate settings and you need both. Second, check TPM 2.0 is enabled (tpm.msc should show version 2.0). Third, fully restart your PC — do not just sleep and wake, Vanguard loads at boot time and needs a cold restart.
Q: My motherboard is old and does not have a Secure Boot option. Can I still play?
A: If your board does not support UEFI with Secure Boot, you cannot play Valorant on Windows 11 with Vanguard. BIOS-only boards (no UEFI) from roughly 2012 and earlier typically lack this feature. You would need a motherboard upgrade. Check if a BIOS update adds the option first.
Q: Will enabling Secure Boot affect my other games or software?
A: For 99% of people, no. Secure Boot only blocks unsigned boot-level drivers. All normal games, apps, and even most kernel anti-cheats work fine with Secure Boot on. The only things that break are unsigned kernel drivers, certain fan control or RGB software that loads very early, and some niche overclocking tools. If something stops working, it will usually tell you it needs Secure Boot disabled — at that point you choose between that software and Valorant.
Q: My kid cannot play Valorant and I do not understand any of this. What is the simplest thing to do?
A: Restart the PC, press Delete repeatedly as it starts up to get to the blue or gray settings screen (BIOS). Look for anything that says Secure Boot and turn it On. Look for anything that says CSM and turn it Off. Press F10 to save. If the PC starts Windows normally after that, open Valorant and try again. If the PC will not start Windows, press and hold the power button to shut off, press it again, go back into that settings screen, turn CSM back On, save with F10, and look up a YouTube video for "enable Secure Boot" plus your motherboard brand for visual guidance.