Uninstalling Valorant sounds like a two-click job until Vanguard gets involved. Riot’s kernel-level anti-cheat leaves behind a driver, two Windows services, a chunk of ProgramData, and registry keys that survive the normal uninstaller more often than you’d expect. Search volume for “uninstall valorant” has held around 590-880 searches a month on Google in the US through late 2025 and into 2026, and a good share of that traffic is people who already ran the uninstaller once and are back because vgc.exe or vgk.sys is still running.

This tutorial takes a different approach than a click-through removal guide. You’ll build a reusable PowerShell script that detects Valorant and Vanguard components, stops and deletes the vgc and vgk services, clears the registry keys tied to them, wipes the leftover folders, and verifies the machine is clean afterward. It supports a dry-run mode so you can preview what it touches before it deletes anything, and it logs every action to a file so you have a record if something goes wrong. By the end you’ll have a working .ps1 file you can run on your own PC, hand to a friend, or adapt for a small LAN center’s fleet of machines.

Why the built-in uninstaller leaves Vanguard behind

Vanguard is not a normal application. It ships two pieces: vgk.sys, a kernel-mode driver that historically loaded at boot before you even logged in, and vgc.exe, a user-mode service that talks to the driver and to Riot’s servers. Windows treats kernel drivers with more caution than regular programs, which is exactly why a standard “Remove Programs” pass on Valorant often uninstalls the game client but not the driver underneath it.

Riot changed part of this equation on June 24, 2026, when it introduced Vanguard On-Demand. On machines running Windows 11 25H2 or later with UEFI Secure Boot, TPM 2.0, Virtualization-Based Security, Hypervisor-Protected Code Integrity, and IOMMU all enabled, the driver now loads only while a Riot game is actually running and unloads when you quit, instead of sitting resident from the moment Windows starts. Riot’s security lead Sonya Koskinas said the switch was possible because 25H2 was the first Windows release to expose the driver attestation reporting Vanguard depends on, according to a report from The Verge. If you’re on Windows 10 or an older Windows 11 build, or your hardware doesn’t clear that security bar, Vanguard keeps running in its classic always-on mode, and that’s the configuration most uninstall problems come from.

Either mode leaves traces after a normal uninstall: the driver file, the service registrations in the registry, and folders under Program Files and ProgramData. A script that checks each of those locations explicitly, rather than trusting the Riot uninstaller to catch everything, is the more reliable way to confirm a clean removal.

How this compares to Windows’ built-in uninstaller

Before writing a single line of PowerShell, it’s worth being clear about what the stock uninstaller actually does versus what it skips. Riot’s uninstaller, launched either through the game client or through Windows Settings > Apps, removes the Valorant game files and unregisters the app entry. It generally does not touch the Vanguard driver at all, since Vanguard is shared infrastructure other Riot titles depend on, and it’s a deliberate design choice, not a bug, that removing one game shouldn’t silently pull anti-cheat out from under another.

TaskWindows Settings uninstallerPowerShell script (this tutorial)
Removes VALORANT game filesYesYes
Removes Riot Client shortcutsYesYes (via ProgramData cleanup)
Stops and deletes vgc/vgk servicesNoYes, unless -KeepVanguard is set
Deletes vgk.sys driver fileNoYes
Cleans orphaned registry keysNoYes
Produces a verifiable log of what changedNoYes
Supports a preview before deleting anythingNoYes, via -DryRun
Repeatable across multiple machinesNo, manual per machineYes, via PowerShell remoting

None of this makes the built-in uninstaller wrong for most players. If you’re switching to League of Legends on the same PC, running the standard uninstaller and leaving Vanguard alone is the correct move. The script in this tutorial is for the specific case where you want every trace gone, or where you’re clearing several machines at once and clicking through the Settings app on each one isn’t practical.

Prerequisites

Gather these before you start. None of it is exotic, but skipping the admin-rights step is the single most common reason this script fails on the first run.

  • Windows 10 (22H2 or later) or Windows 11, any build — the script works on both, though On-Demand-specific checks only apply on 25H2+
  • PowerShell 5.1 (built into Windows) or PowerShell 7.4+ if you’ve installed it separately; the script avoids any 7.x-only syntax so it runs on both
  • An account with local administrator rights — service and driver removal will not work from a standard user session
  • Valorant already closed, and Riot Client fully exited from the system tray
  • About 15-20 minutes, plus a restart at the end
  • A text editor (VS Code, Notepad++, or even Notepad) to save the script as a .ps1 file

You do not need to disable your antivirus. Some endpoint tools flag scripts that touch System32\drivers or delete services, so if your script gets quarantined mid-run, check your antivirus’s activity log before assuming the script itself is broken.

Before you begin: back up anything you want to keep

The script targets application files, not your Riot account, so your rank, skins, and purchase history live on Riot’s servers and are untouched no matter what you delete locally. What isn’t safe is anything stored only on your machine: your custom crosshair code, keybinds, and video settings, since those live in local config files under the Valorant install folder and get wiped along with everything else.

If you plan to reinstall later and want your exact crosshair back, write down the crosshair export code from the in-game settings menu before you start (Settings > Crosshair > Profile Code). It’s a short string you can paste back in after reinstalling, and there’s no way to recover it after the local files are gone if you didn’t save it somewhere else first.

Step 1: Set up your working folder and execution policy

Open PowerShell as Administrator (right-click the Start button, choose “Terminal (Admin)” or “Windows PowerShell (Admin)”). Create a folder to hold the script and its log output.

mkdir C:\ValorantUninstaller
cd C:\ValorantUninstaller
Get-ExecutionPolicy -List

If Get-ExecutionPolicy -List shows the LocalMachine or CurrentUser scope set to Restricted, you’ll need to allow local scripts to run for this session. Don’t set this globally to Unrestricted; scope it to the current process instead so you’re not loosening security policy on the whole machine.

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force

This setting resets when you close the window, so there’s nothing to undo later.

Step 2: Define the target paths and service names

Start the script file itself. Create Uninstall-Valorant.ps1 in your editor and begin with a parameter block and the list of known Vanguard and Valorant locations. Putting these in a table up front makes the rest of the script easier to read and easier to extend later if Riot changes a path.

[CmdletBinding()]
param(
    [switch]$DryRun,
    [switch]$KeepVanguard,
    [string]$LogPath = "$PSScriptRoot\uninstall-log.txt"
)

$services = @('vgc', 'vgk')

$paths = @(
    "$env:ProgramFiles\Riot Vanguard",
    "$env:SystemRoot\System32\drivers\vgk.sys",
    "$env:ProgramData\Riot Games\Vanguard",
    "$env:ProgramData\Riot Games",
    "C:\Riot Games\VALORANT",
    "$env:LOCALAPPDATA\VALORANT"
)

$registryKeys = @(
    'HKLM:\SYSTEM\CurrentControlSet\Services\vgk',
    'HKLM:\SYSTEM\CurrentControlSet\Services\vgc'
)

The -DryRun switch is the safety net for this whole script: run it once with that flag before you ever run it for real, so you can see exactly what it plans to touch. The -KeepVanguard switch matters if you also play League of Legends or another Riot title on the same machine and want the game gone without pulling the anti-cheat that title still needs.

Step 3: Write a logging function

A script that deletes drivers and registry keys should leave a paper trail. Add a small logging function near the top of the file, right after the parameter block, and call it instead of using bare Write-Host for anything that matters.

function Write-Log {
    param(
        [string]$Message,
        [ValidateSet('INFO', 'WARN', 'ACTION', 'ERROR')]
        [string]$Level = 'INFO'
    )
    $stamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    $line = "[$stamp] [$Level] $Message"
    Write-Host $line
    Add-Content -Path $LogPath -Value $line
}

Write-Log "Uninstall session started. DryRun=$($DryRun.IsPresent) KeepVanguard=$($KeepVanguard.IsPresent)"

Every meaningful action from here forward should route through Write-Log. If you ever need to prove to yourself (or a teammate) exactly what a run did, the log file is the record.

Step 4: Confirm the script is running elevated

Rather than let service deletion fail silently with an access-denied error deep into the script, check for admin rights up front and exit cleanly if they’re missing.

$currentUser = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($currentUser)
$isAdmin = $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

if (-not $isAdmin) {
    Write-Log "This script must run in an elevated (Administrator) PowerShell session." -Level ERROR
    exit 1
}

If this check fails, close the window and reopen PowerShell using “Run as Administrator.” There’s no way around this step: driver and kernel service removal requires elevation on every supported Windows version.

Step 5: Detect what’s actually installed

Before touching anything, scan the machine and report what’s present. This step alone is useful even outside the uninstall flow, since it tells you whether Vanguard is currently in always-on mode or On-Demand mode.

function Get-VanguardState {
    $found = [ordered]@{}
    foreach ($svc in $services) {
        $s = Get-Service -Name $svc -ErrorAction SilentlyContinue
        $found[$svc] = if ($s) { $s.Status.ToString() } else { 'Not present' }
    }
    foreach ($p in $paths) {
        $found[$p] = (Test-Path $p)
    }
    return $found
}

$state = Get-VanguardState
$state.GetEnumerator() | ForEach-Object {
    Write-Log "Detected: $($_.Key) = $($_.Value)"
}

Run the script up to this point on its own (comment out everything below temporarily, or just watch the console output) and check that the services and paths it finds match what you expect. If vgc and vgk both show “Not present” already, Vanguard may have been removed in a previous attempt and you can skip straight to the file cleanup steps.

Step 6: Stop and delete the Riot Client and Valorant processes

Before you can safely remove the underlying files, close any lingering Riot processes. Leaving Riot Client open is one of the most common reasons a manual uninstall fails partway through.

$processNames = @('VALORANT-Win64-Shipping', 'RiotClientServices', 'RiotClientUx', 'vgc')

foreach ($name in $processNames) {
    $proc = Get-Process -Name $name -ErrorAction SilentlyContinue
    if ($proc) {
        if ($DryRun) {
            Write-Log "DRY RUN: would stop process $name (PID $($proc.Id))" -Level ACTION
        } else {
            Write-Log "Stopping process $name" -Level ACTION
            Stop-Process -Name $name -Force -ErrorAction SilentlyContinue
        }
    }
}

Give Windows a couple of seconds after this block runs before moving to service removal, since a process can take a moment to fully release its file locks.

Start-Sleep -Seconds 2

Step 7: Stop and delete the vgc and vgk services

This is the core of the removal. PowerShell can stop a service natively with Stop-Service, but deleting a service still requires sc.exe (the command-line Service Controller) since PowerShell’s built-in cmdlets don’t expose a delete operation for Windows services on 5.1. Wrap both in the function below, and respect the -KeepVanguard switch.

function Remove-VanguardService {
    param([string]$Name)

    $svc = Get-Service -Name $Name -ErrorAction SilentlyContinue
    if (-not $svc) {
        Write-Log "Service $Name not found, skipping" -Level INFO
        return
    }

    if ($DryRun) {
        Write-Log "DRY RUN: would stop and delete service $Name" -Level ACTION
        return
    }

    try {
        if ($svc.Status -ne 'Stopped') {
            Stop-Service -Name $Name -Force -ErrorAction Stop
            Write-Log "Stopped service $Name" -Level ACTION
        }
        $result = sc.exe delete $Name
        Write-Log "Deleted service $Name : $result" -Level ACTION
    }
    catch {
        Write-Log "Failed to remove service $Name : $($_.Exception.Message)" -Level ERROR
    }
}

if (-not $KeepVanguard) {
    foreach ($svc in $services) {
        Remove-VanguardService -Name $svc
    }
} else {
    Write-Log "KeepVanguard flag set — leaving vgc/vgk services in place" -Level INFO
}

Order matters here: stop vgc before vgk where possible, since the user-mode service depends on the kernel driver being present while it shuts down cleanly. The loop above processes the array in the order it was defined, which already puts vgc first.

Step 8: Clean up the registry keys

sc.exe delete usually removes the associated registry key along with the service, but it’s worth verifying and cleaning up manually in case a key survives (which happens more often after a previous failed uninstall attempt left things in a partial state).

if (-not $KeepVanguard) {
    foreach ($key in $registryKeys) {
        if (Test-Path $key) {
            if ($DryRun) {
                Write-Log "DRY RUN: would remove registry key $key" -Level ACTION
            } else {
                try {
                    Remove-Item -Path $key -Recurse -Force -ErrorAction Stop
                    Write-Log "Removed registry key $key" -Level ACTION
                }
                catch {
                    Write-Log "Failed to remove registry key $key : $($_.Exception.Message)" -Level ERROR
                }
            }
        } else {
            Write-Log "Registry key $key already absent" -Level INFO
        }
    }
}

If this block throws an access-denied error even though you’re running elevated, it usually means a handle to the key is still open somewhere (often a leftover Services console window). Close Services.msc if you have it open, and rerun just this part of the script.

Step 9: Remove the leftover files and folders

With the services and registry entries gone, clear the files. This is the step that actually frees up disk space, since the Valorant install folder and its shader cache can run into several gigabytes. PowerShell’s Remove-Item cmdlet handles both files and folders with the same syntax.

$targetPaths = if ($KeepVanguard) {
    $paths | Where-Object { $_ -notmatch 'Vanguard|vgk\.sys' }
} else {
    $paths
}

foreach ($p in $targetPaths) {
    if (Test-Path $p) {
        if ($DryRun) {
            Write-Log "DRY RUN: would remove $p" -Level ACTION
        } else {
            try {
                Remove-Item -Path $p -Recurse -Force -ErrorAction Stop
                Write-Log "Removed $p" -Level ACTION
            }
            catch {
                Write-Log "Failed to remove $p : $($_.Exception.Message)" -Level ERROR
            }
        }
    } else {
        Write-Log "$p not found, skipping" -Level INFO
    }
}

Note that C:\Riot Games\VALORANT assumes the default install location. If you installed on a different drive, edit the $paths array back in Step 2 to match, or add a parameter that lets you pass a custom install root.

Step 10: Verify the removal

Reuse the detection function from Step 5 to confirm the cleanup actually worked, and print a clear pass/fail summary instead of making the user scroll back through the log.

if (-not $DryRun) {
    Write-Log "Running post-removal verification..." -Level INFO
    $finalState = Get-VanguardState
    $leftovers = $finalState.GetEnumerator() | Where-Object {
        ($_.Value -eq $true) -or ($_.Value -notin @('Not present', $false))
    }

    if ($leftovers) {
        Write-Log "Items still present after cleanup:" -Level WARN
        $leftovers | ForEach-Object { Write-Log " - $($_.Key): $($_.Value)" -Level WARN }
    } else {
        Write-Log "Verification passed: no Vanguard/Valorant components detected" -Level INFO
    }
}

A clean run should print something close to this in your console:

[2026-09-20 14:12:03] [INFO] Uninstall session started. DryRun=False KeepVanguard=False
[2026-09-20 14:12:04] [ACTION] Stopping process RiotClientServices
[2026-09-20 14:12:07] [ACTION] Stopped service vgc
[2026-09-20 14:12:07] [ACTION] Deleted service vgc : [SC] DeleteService SUCCESS
[2026-09-20 14:12:08] [ACTION] Stopped service vgk
[2026-09-20 14:12:08] [ACTION] Deleted service vgk : [SC] DeleteService SUCCESS
[2026-09-20 14:12:08] [ACTION] Removed registry key HKLM:\SYSTEM\CurrentControlSet\Services\vgk
[2026-09-20 14:12:09] [ACTION] Removed C:\Program Files\Riot Vanguard
[2026-09-20 14:12:11] [ACTION] Removed C:\Riot Games\VALORANT
[2026-09-20 14:12:11] [INFO] Verification passed: no Vanguard/Valorant components detected

If your output instead lists leftover items under a WARN line, jump to the troubleshooting table further down before rerunning the script.

Step 11: Restart and run a final check

Windows can hold a lock on vgk.sys even after the service is deleted, particularly if the driver was loaded at boot in always-on mode. Restart before declaring victory.

Write-Log "Cleanup complete. A restart is recommended to release any remaining driver locks." -Level INFO
Restart-Computer -Confirm

The -Confirm flag stops the script from restarting your machine without warning; you’ll get a prompt you can cancel if you want to review the log first. After the restart, open PowerShell as Administrator one more time and run a one-line check:

Get-Service -Name vgc, vgk -ErrorAction SilentlyContinue
Test-Path "$env:SystemRoot\System32\drivers\vgk.sys"

Both commands should come back empty or False. If they do, the machine is clean.

Step 12: Package it as a reusable tool

Once the script works end to end, save it somewhere outside C:\ValorantUninstaller so a future Windows reinstall doesn’t wipe it along with everything else — a synced folder like OneDrive or a USB stick works fine. Add a short comment block at the top describing the parameters, and you have a tool you can reuse the next time you, or someone you’re helping, needs a clean Valorant removal.

# Usage:
#   .\Uninstall-Valorant.ps1                  -> full removal
#   .\Uninstall-Valorant.ps1 -DryRun          -> preview only, no changes
#   .\Uninstall-Valorant.ps1 -KeepVanguard    -> removes VALORANT files, leaves vgc/vgk intact

The full script from Steps 1 through 11, in order, is the complete working project for this tutorial. Copy each block into a single .ps1 file in the sequence shown and it runs as one piece, nothing needs to be pasted directly into the console.

Reference table: services, paths, and what they do

ComponentTypeDefault locationPurpose
vgkKernel-mode driverC:\Windows\System32\drivers\vgk.sysLoads at boot (always-on mode) or on launch (On-Demand mode) to enforce anti-cheat checks
vgcUser-mode serviceC:\Program Files\Riot Vanguard\vgc.exeRuns in the background, communicates with the driver and Riot’s servers
Vanguard install folderProgram directoryC:\Program Files\Riot VanguardHolds Vanguard binaries and update files
Riot ProgramDataShared data folderC:\ProgramData\Riot Games\VanguardConfiguration and logs used across Riot titles
Valorant install folderGame directoryC:\Riot Games\VALORANTGame client, assets, shader cache
Per-user Valorant dataUser profile folder%LOCALAPPDATA%\VALORANTLocal settings, crash logs, per-account cache

Common pitfalls

These are the mistakes that trip people up most often when running an uninstall script like this one, in rough order of how frequently they come up.

  • Running PowerShell without elevation. Service deletion and driver file removal both fail silently or throw access-denied errors from a standard, non-admin window.
  • Leaving Riot Client open in the system tray. A running RiotClientServices.exe process can hold a file lock that blocks folder deletion even after the visible app window is closed.
  • Skipping the dry run. The paths array includes broad folders like ProgramData\Riot Games — if you’ve customized paths and made a typo, a dry run catches it before anything is deleted.
  • Assuming a non-default install path. If Valorant was installed to a drive other than C:, the hardcoded path in the script won’t match and files will be silently skipped rather than removed.
  • Not restarting before re-checking. vgk.sys can still show as present in File Explorer immediately after service deletion because Windows hasn’t released the file handle yet.
  • Confusing KeepVanguard’s purpose. The switch is meant for players who still use Vanguard for another Riot title; using it when you actually want a full removal leaves the anti-cheat driver in place.
  • Running the script while a Windows Update is pending a restart. Pending updates can interfere with registry writes to the Services key; reboot first, then run the script.
  • Ignoring antivirus quarantine notifications. Some AV products flag any script that deletes a kernel driver file, which can silently stop the removal partway through without an obvious PowerShell error.

Troubleshooting

SymptomLikely causeFix
“Access is denied” on Stop-ServicePowerShell window isn’t elevatedClose the window, reopen with “Run as Administrator,” rerun the script
sc.exe delete returns [SC] DeleteService FAILED 1072Service is marked for deletion but a handle to it is still openClose Services.msc and any Task Manager tab showing the service, then restart and rerun
Remove-Item fails on vgk.sys with “in use by another process”Driver is currently loaded (always-on mode)Delete the service first, restart Windows, then delete the file — the driver unloads on reboot
Registry key still exists after sc.exe deletePartial removal from a previous manual attempt left a stale entryRun Step 8’s registry cleanup block directly; it checks Test-Path before acting, so it’s safe to rerun
VALORANT folder won’t delete, “path too long” errorNested shader cache paths exceed the legacy 260-character limitEnable long path support via Group Policy, or delete the shader cache subfolder separately first
Script reports vgc/vgk as “Not present” but Valorant still launches fineYou’re testing on a machine where Vanguard is already using On-Demand mode and simply isn’t loaded right nowLaunch Valorant once to force the driver to load, then close the game and rerun detection
Error 1: Incorrect Function when the Riot installer tries to reinstall laterA leftover, misregistered vgc entry from an incomplete prior uninstallConfirm Step 7 and Step 8 both completed without errors in the log, then reinstall from Riot’s official client
Valorant -81 / League of Legends VAN 57 after reinstallingvgk.sys exists on disk but isn’t registered as a kernel serviceRe-run the official Vanguard installer rather than trying to hand-register the driver; this resets the service registration cleanly
Script hangs on Stop-Process for vgcvgc.exe is protected against termination while actively performing an integrity checkWait 10-15 seconds and let the script’s timeout pass, or reboot into Safe Mode and rerun

Advanced tips: running this across multiple machines

If you’re clearing Vanguard off more than one PC (a home with several gaming rigs, or a small LAN setup), you don’t need to remote-desktop into each one individually. PowerShell remoting lets you push the same script to multiple targets from a single session, as long as WinRM is enabled and you have admin credentials on each machine.

$targets = @('PC-Bedroom', 'PC-Living-Room', 'PC-Office')
$cred = Get-Credential

foreach ($t in $targets) {
    Invoke-Command -ComputerName $t -Credential $cred -FilePath .\Uninstall-Valorant.ps1 -ArgumentList $false
}

For anything beyond a handful of home machines, look at how IT teams handle this at scale rather than looping Invoke-Command manually. Group Policy and endpoint management tools have their own patterns for pushing kernel-driver removal in bulk, and doing this on unmanaged machines by hand doesn’t scale past a few PCs before it becomes its own maintenance burden.

One more tip worth building in: wrap the whole script body in a try/finally block so the log always closes out with a clear “session ended” line, even if something throws midway. That single change makes it much easier to tell, weeks later, whether a given run actually finished or died partway through.

try {
    # Steps 4 through 11 go here
}
finally {
    Write-Log "Session ended."
}

You can also extend the script to catch two categories it doesn’t touch by default: scheduled tasks and firewall rules. Vanguard’s installer sometimes registers a scheduled task for update checks, and Windows Firewall may hold inbound/outbound rules tied to VALORANT-Win64-Shipping.exe. Add this block after Step 9 if you want a more exhaustive sweep.

$tasks = Get-ScheduledTask | Where-Object { $_.TaskName -match 'Vanguard|Riot' }
foreach ($t in $tasks) {
    if ($DryRun) {
        Write-Log "DRY RUN: would remove scheduled task $($t.TaskName)" -Level ACTION
    } else {
        Unregister-ScheduledTask -TaskName $t.TaskName -Confirm:$false
        Write-Log "Removed scheduled task $($t.TaskName)" -Level ACTION
    }
}

$fwRules = Get-NetFirewallRule | Where-Object { $_.DisplayName -match 'VALORANT|Vanguard|Riot' }
foreach ($rule in $fwRules) {
    if ($DryRun) {
        Write-Log "DRY RUN: would remove firewall rule $($rule.DisplayName)" -Level ACTION
    } else {
        Remove-NetFirewallRule -Name $rule.Name
        Write-Log "Removed firewall rule $($rule.DisplayName)" -Level ACTION
    }
}

Neither of these leftovers causes the kind of reinstall errors that a stray vgk.sys registration does, so treat this block as optional polish rather than a required step.

What this script won’t do

Worth being explicit about the boundaries here. This script does not touch your Riot account, your rank, your skins, or anything stored server-side, since none of that lives on your PC in the first place. It doesn’t modify BIOS or UEFI settings, and it doesn’t disable Secure Boot, TPM, or any of the hardware security features Vanguard’s On-Demand mode checks for, those stay exactly as configured. It also doesn’t uninstall other Riot titles like League of Legends or Teamfight Tactics; if you run those on the same machine, they keep working normally as long as you used the -KeepVanguard switch or reinstall Vanguard afterward through any Riot game’s installer.

A note on the security context behind Vanguard removal

Kernel-level anti-cheats like Vanguard depend on the same hardware security stack that protects the rest of Windows: Secure Boot, TPM 2.0, VBS, and HVCI. That stack had a rough 2025. A firmware bug affecting several motherboard vendors picked up four separate CVE identifiers, CVE-2025-11901 for Asus, CVE-2025-14302 for Gigabyte, CVE-2025-14303 for MSI, and CVE-2025-14304 for ASRock, coordinated through CERT/CC advisory VU#382314. The following spring, Microsoft shipped a mitigation for CVE-2026-23670, an attack technique nicknamed “Download More RAM” that manipulated writable memory-module configuration data to weaken VBS and HVCI protections, a class of vulnerability that matters directly to kernel drivers like vgk.sys.

None of that changes how you uninstall Vanguard, but it’s worth keeping Windows and motherboard firmware updated before and after running a script like this one. A machine with stale firmware is the kind of machine where kernel-level software, anti-cheat or otherwise, behaves unpredictably.

Testing the script safely before you trust it

Before running the full removal on your primary gaming PC, test the dry-run mode and read through every logged line. It costs nothing and catches the two most common authoring mistakes: a typo in a file path (which just gets silently skipped, no harm done) and a services array that’s missing a service name (which means that service won’t be touched at all).

.\Uninstall-Valorant.ps1 -DryRun

Compare the dry-run output against the reference table above. If every row in that table shows up as detected, or correctly shows “not found” for anything you already removed manually, you’re ready to drop the flag and run it live.

If you’re editing the paths or services arrays for your own setup and want to be extra cautious, test on a Windows virtual machine with Valorant installed before touching your main PC. A VM lets you break something, snapshot back, and try again without any risk to your actual gaming rig, and it’s the fastest way to catch a bad path edit before it matters.

Scheduling a periodic check instead of a one-time run

If you’re managing a shared PC where different people install and remove Valorant over time, a one-off cleanup only solves the problem until the next install. A lighter option is to schedule the detection function from Step 5 on its own, without the removal steps, so you get a weekly report of whether Vanguard is present rather than running the full uninstall repeatedly.

Save just the detection logic into a separate file, Check-VanguardState.ps1, and register it as a scheduled task that writes to the same log format used by the uninstaller.

$action = New-ScheduledTaskAction -Execute 'powershell.exe' `
    -Argument '-NoProfile -ExecutionPolicy Bypass -File "C:\ValorantUninstaller\Check-VanguardState.ps1"'
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 9am
Register-ScheduledTask -TaskName 'VanguardStateCheck' -Action $action -Trigger $trigger -RunLevel Highest

This is optional and mostly useful in a household or small shared-machine setup where you want visibility without having to remember to check manually. On a single personal PC, running the full script on demand, whenever you’re actually done with the game, is simpler and does the job.

Frequently asked questions

Does this script work if I have Vanguard On-Demand mode enabled?
Yes. On-Demand mode changes when the vgk driver loads, not where its files live or what its service is named, so the same detection and removal logic applies. The one difference is that Get-Service may show vgk as “Stopped” rather than “Running” if no Riot game is currently open, since the driver isn’t loaded until launch.

Will this also remove League of Legends if I have both installed?
No. The script only targets Valorant-specific paths like the VALORANT install folder and its LOCALAPPDATA data. Vanguard itself is shared across Riot titles, so if you use -KeepVanguard, League of Legends keeps working normally after Valorant is gone.

Do I need to reinstall Vanguard separately if I reinstall Valorant later?
No, the official Valorant installer bundles the Vanguard installer and sets up both automatically. You don’t need to download or register vgk.sys by hand.

Is it safe to delete vgk.sys manually with File Explorer instead of the script?
It’s possible but riskier, since File Explorer won’t stop the associated service first or clean up the registry key pointing to the now-missing file. That mismatch is exactly the kind of leftover state that causes errors like -81 or VAN 57 the next time you try to reinstall.

Why does the script use sc.exe instead of a pure PowerShell cmdlet for deleting services?
PowerShell 5.1 doesn’t ship a native “delete service” cmdlet; Remove-Service was only added in PowerShell 6+. Using sc.exe delete keeps the script compatible with the version of PowerShell that ships by default on every supported Windows install.

What if antivirus software blocks the script from running?
Check your antivirus’s quarantine or activity log first. Deleting a kernel driver file is a legitimate but unusual action, and some endpoint tools flag it by default. You may need to add a temporary exclusion for the script’s folder, or run it with your antivirus’s real-time protection briefly paused.

Can I run this on a laptop that doesn’t meet the On-Demand hardware requirements?
Yes, the script doesn’t care which Vanguard mode a machine is running. Machines without Windows 11 25H2, TPM 2.0, VBS, HVCI, and IOMMU simply keep running Vanguard in the older always-on configuration, and the same services and paths still apply.

How do I know the script actually removed everything and didn’t just report success?
Step 10’s verification pass rereads the same detection function used in Step 5, so it’s checking live system state rather than trusting its own earlier actions. Still, the restart in Step 11 and the manual double-check with Get-Service afterward are worth doing every time, since a locked file can occasionally report as removed before Windows has actually released its handle.