Uninstalling Valorant is supposed to take two clicks. For a large share of players it doesn’t work that way. The game folder disappears, Riot Client goes with it, and then Windows keeps loading a kernel driver called vgk.sys anyway. Some machines blue-screen on the next boot. Others simply refuse to let Vanguard reinstall later, throwing an error that says the anti-cheat is “already installed” when Task Manager shows no such service running. This tutorial walks through the actual fix: stopping and deleting the Vanguard services by hand, clearing the driver from the kernel, cleaning the registry keys that survive a normal uninstall, and confirming Windows is genuinely clean afterward.
This is not a rehash of the standard “uninstall Valorant” walkthrough. It’s for the subset of cases where that walkthrough already failed you: the uninstaller hangs, vgk.sys throws a blue screen after the game is gone, or Riot Vanguard shows up in Windows Settings but won’t budge no matter how many times you click Uninstall. We’ll build a complete, repeatable removal script, cover the registry and driver-store cleanup Riot’s own support page glosses over, and finish with a verification pass so you’re not guessing whether the driver is really gone.
Why the Standard Valorant Uninstall Leaves Vanguard Behind
Vanguard is not part of Valorant. It’s a separate kernel-mode driver plus a user-mode service, installed independently so it can start before Windows finishes booting and watch for cheat software at the lowest level the OS allows. That separation is the whole point of the anti-cheat, but it’s also why deleting the game doesn’t remove it. Uninstalling Valorant through Windows Settings or the Riot Client only removes the game client and its launcher shortcuts. Riot Vanguard is listed as its own entry in “Installed apps,” and it has to be uninstalled separately, in the right order, or pieces of it get stranded.
Two components are doing the work. vgk.sys is the kernel driver, sitting in C:\Windows\System32\drivers\vgk.sys, and it loads at boot regardless of whether Valorant is running. vgc.exe is the user-mode service, installed under C:\Program Files\Riot Vanguard\, and it’s the process that talks to Riot’s servers and manages the driver’s lifecycle. According to Riot Games Support’s uninstall documentation, both the vgc and vgk Windows services have to be deleted with the sc delete command before the Riot Vanguard folder is removed, or the driver can stay registered even after the folder is gone. Skip that step and Windows still thinks the driver belongs in the boot sequence.
Once that mismatch happens, three things tend to go wrong. First, vgk.sys keeps loading at every boot with no Valorant installed to pair with it, which is the scenario behind most “vgk.sys blue screen after uninstall” reports. Second, a later reinstall attempt fails because the old service registration collides with the new one Riot Client tries to create. Third, some third-party uninstaller tools remove the folder but never touch the registry keys or the driver file itself, so File Explorer looks clean while sc query vgk still returns a live service. Each of those is fixable, and each one is covered below.
Prerequisites and What You’ll Need
This is a Windows-only procedure. You’ll need administrator access on the machine, because every command below has to run from an elevated prompt. Here’s the full checklist before you start:
- Windows 10 (22H2 or later) or Windows 11, any current feature update (the service and driver names haven’t changed across recent builds)
- A local account with administrator rights (domain-restricted work laptops may block
sc delete, see the Troubleshooting section) - Command Prompt or PowerShell, both run as Administrator
- Regedit access, in case the GUI registry editor is faster for you than
reg delete - About 20-30 minutes, plus one required reboot partway through
- Optional: Sysinternals Autoruns, for visually confirming the driver’s boot entry is gone
- A backup of anything unsaved, this touches system services and a kernel driver, and a bad registry edit on unrelated keys can cause boot problems, so stay inside the paths listed in this guide
If Valorant is still installed and you just want a normal removal with no complications, use the standard Settings → Apps flow first. This guide is for when that flow already failed, or when you’ve already removed the game and are left cleaning up a stuck Vanguard driver.
Step 1: Confirm What’s Actually Still Installed
Before deleting anything, check what Windows currently believes is installed. Open Settings → Apps → Installed apps and search “vanguard.” If Riot Vanguard shows up there, note whether clicking Uninstall does anything at all, a silent failure (the entry stays, no error, no progress bar) is a different problem than an error dialog, and it changes which fix you need later.
Next, open an elevated Command Prompt (right-click Start, choose “Terminal (Admin)” or “Command Prompt (Admin)”) and query both services directly:
sc query vgc
sc query vgkIf either command returns STATE: 4 RUNNING or STATE: 1 STOPPED, the service is still registered with Windows, whether or not the Riot Vanguard folder still exists. If you get [SC] EnumQueryServicesStatus:OpenService FAILED 1060, that service is already gone. Skip the delete step for that one and move to the file and registry checks further down. Write down which of the two services responded, since that tells you exactly how much cleanup is left.
Step 2: Stop Both Vanguard Services
You can’t delete a running service. Stop both before touching anything else:
sc stop vgc
sc stop vgkvgc usually stops cleanly since it’s a normal user-mode service. vgk is a kernel driver, and Windows will sometimes refuse to stop it while it’s actively loaded, returning The service cannot accept control messages at this time. That’s expected for a driver that’s marked to load at boot: it’s not designed to be stopped while Windows is running, only prevented from loading on the next boot. If sc stop vgk fails with that message, don’t fight it here. Proceed to Step 3 and let the delete-plus-reboot sequence handle it instead.
Step 3: Delete the Services
This is the step Riot’s own support documentation calls out as mandatory before you touch the Riot Vanguard folder. Run both delete commands from the same elevated prompt:
sc delete vgc
sc delete vgkA successful run prints [SC] DeleteService SUCCESS for each. If you see [SC] OpenService FAILED 1060, the service was already removed (fine, nothing to do). If you see ACCESS DENIED, your Command Prompt isn’t actually elevated. Close it and reopen as Administrator rather than trying to force past the error.
Deleting a service doesn’t remove it from memory immediately, Windows marks it “pending deletion” and finishes the job on the next reboot. This is why the reboot in Step 4 isn’t optional, even if everything above looked successful. Skipping it is the single most common reason people repeat this whole process a second time.
Step 4: Reboot Before Doing Anything Else
Restart Windows now, before deleting files or editing the registry. The kernel driver vgk.sys is loaded in memory and locked by the OS while Windows is running. You cannot delete the file, and registry entries tied to a pending-deletion service can behave unpredictably, until after a full reboot unloads it. A save-your-work-and-restart is enough. You don’t need Safe Mode for this step.
After the machine comes back, re-run the two sc query commands from Step 1. Both should now return OpenService FAILED 1060, confirming the services are gone. If either one still responds, something re-registered it, check whether Riot Client auto-launched and reinstalled Vanguard in the background (this happens if Riot Client is still installed and set to run at startup), and remove Riot Client first if so.
Step 5: Delete the Vanguard Program Files
With the services gone, remove the leftover folder. Open File Explorer and navigate to C:\Program Files\Riot Vanguard, or delete it from an elevated prompt:
rmdir /s /q "C:\Program Files\Riot Vanguard"If the folder is already gone, or this command returns The system cannot find the file specified, that’s fine. It means a prior uninstall attempt already cleared it, and your problem was purely the orphaned services and driver, not the files. Check C:\Windows\System32\drivers\vgk.sys too. If the service deletion in Step 3 completed and you rebooted, that file should already be gone on its own. If it’s still there, delete it manually. You’ll need admin rights and, in rare cases, ownership of the file first (see Troubleshooting below).
Step 6: Clear the Leftover Registry Keys
This is the step most uninstall guides skip, and it’s usually why a later reinstall of Vanguard fails with a vague “installation error” even though nothing shows up in Installed Apps. Windows can leave service registration keys behind under CurrentControlSet even after sc delete reports success, especially if the delete happened without a follow-up reboot the first time around. Check and clear both keys from an elevated Command Prompt:
reg query "HKLM\SYSTEM\CurrentControlSet\Services\vgk"
reg query "HKLM\SYSTEM\CurrentControlSet\Services\vgc"
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\vgk" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\vgc" /fRun the two query commands first, if they return ERROR: The system was unable to find the specified registry key, both keys are already clean and you can skip straight to Step 7. Only run the delete commands if the query actually finds something. These keys live under CurrentControlSet\Services, which also holds every other driver and service on the machine, so double-check you typed vgk and vgc exactly (not a similar-looking key) before confirming the delete.
Step 7: Handle the vgk.sys Blue Screen Case Separately
If your actual symptom was a blue screen referencing vgk.sys, commonly a PAGE_FAULT_IN_NONPAGED_AREA or DRIVER_IRQL_NOT_LESS_OR_EQUAL stop code, rather than a stuck uninstaller, the fix path is a little different because you may not be able to boot normally long enough to run the commands above.
Boot into Safe Mode first: hold Shift while clicking Restart from the Windows sign-in screen, then go to Troubleshoot → Advanced options → Startup Settings → Restart, and press 4 (or F4) for Safe Mode. Vanguard’s driver still loads in Safe Mode in some configurations, so if you continue to crash, use Safe Mode with Networking disabled, or boot to the Advanced options Command Prompt instead and run the sc stop / sc delete sequence from Steps 2-3 directly from there before Windows fully starts. Once the services are deleted, reboot normally and pick the process back up at Step 5.
You can confirm vgk.sys was actually the crash cause by checking the minidump after the fact. Open an elevated PowerShell and run:
Get-WinEvent -LogName System -MaxEvents 20 | Where-Object { $_.Id -eq 1001 } | Format-List TimeCreated, MessageEvent ID 1001 entries after a crash list the failing module. If vgk.sys appears there repeatedly across multiple boots, that’s a solid signal the driver (not unrelated hardware) is the trigger, and removing it fully (this guide) rather than just reinstalling Vanguard is the right call.
Step 8: Remove Riot Client Too, If You’re Leaving the Ecosystem Entirely
If your goal is a completely clean machine (not just fixing a stuck Vanguard), Riot Client itself needs to go as well, since it will silently reinstall Vanguard the next time it launches (including via a scheduled task some installs set up). Uninstall it from Settings → Apps like any other program, then clear its remaining folders:
rmdir /s /q "C:\Program Files\Riot Games"
rmdir /s /q "C:\ProgramData\Riot Games"
rmdir /s /q "%LOCALAPPDATA%\Riot Games"Skip this step if you play League of Legends or any other Riot title on the same machine. Riot Client and Vanguard are shared across Riot’s catalog now, and removing them will affect those games too. This is the one point in the guide where “more thorough” isn’t automatically “better.” Scope the cleanup to what you actually intend to stop using.
Step 9: Use the Official Uninstaller as a Cross-Check
Once the manual cleanup is done, it’s worth running Riot’s own uninstaller tool against the same machine as a sanity check, even though there should be nothing left for it to find. If vgc_installer.exe is still present anywhere on disk (check C:\ProgramData\Riot Games\RiotClientInstalls.json for its last known path if you’re not sure), run it with the uninstall flag from an elevated prompt:
vgc_installer.exe /uninstallA clean machine will typically report nothing to remove, or exit without error. If it instead finds and removes something, that means Steps 3-6 missed a component, go back and re-run the sc query checks from Step 1 to see what’s still registered, then repeat the relevant delete step.
Step 10: Third-Party Force-Removal Tools, When Needed
On a small number of machines, usually ones where a prior uninstall attempt half-completed, or where third-party antivirus flagged and quarantined part of Vanguard mid-install, the manual steps above won’t fully clear the “Installed apps” entry even after the driver and services are gone. In that case, a dedicated force-removal utility such as HiBit Uninstaller’s Force Removal mode (with Advanced Scan enabled) can clear the stale Programs and Features registration that Windows itself won’t budge on. Point it at the Valorant, Riot Vanguard, and Riot Client entries specifically, let it run its post-removal scan, and reboot once more afterward. Don’t reach for this as a first step. It’s a cleanup tool for a registration Windows refuses to forget, not a substitute for the service and driver removal in Steps 2-6, which have to happen first regardless.
Which path actually applies to your machine depends on how far the original uninstall got before it stalled. The table below breaks down the three removal approaches covered in this guide, what each one actually touches, and when it’s the right tool for the job rather than overkill.
| Method | What it removes | When to use it |
|---|---|---|
| Manual sc/reg cleanup (Steps 2-6) | Services, kernel driver, registry keys, program folder | Default path for almost every case, start here first |
| Safe Mode + service delete (Step 7) | Same as above, run before Windows finishes a normal boot | Only when a vgk.sys crash prevents reaching a stable desktop |
| Official vgc_installer.exe /uninstall (Step 9) | Whatever Riot’s own installer database still tracks | Cross-check after manual cleanup, or as a first attempt if Vanguard is otherwise healthy |
| Third-party force-removal tool (Step 10) | Stale Programs and Features registration only | Last resort, only after Steps 2-6 already ran |
Notice that only the first two rows actually touch the kernel driver and its registry keys. That’s the detail that trips people up: a force-removal tool can make the Installed Apps list look clean while vgk.sys is still sitting in the drivers folder, which is exactly the mismatch that causes a blue screen weeks later with no obvious trigger. If you’ve only ever run a third-party uninstaller and never the sc delete commands, treat the job as unfinished regardless of what Settings shows.
Step 11: Verify the Driver Is Actually Gone
Don’t take “it looks clean” on faith. Run this final check from an elevated PowerShell window:
Get-Service -Name vgc,vgk -ErrorAction SilentlyContinue
Test-Path "C:\Windows\System32\drivers\vgk.sys"
Test-Path "C:\Program Files\Riot Vanguard"
Get-Item "HKLM:\SYSTEM\CurrentControlSet\Services\vgk" -ErrorAction SilentlyContinue
Get-Item "HKLM:\SYSTEM\CurrentControlSet\Services\vgc" -ErrorAction SilentlyContinueA fully clean system returns nothing for Get-Service, False for both Test-Path checks, and nothing for both registry Get-Item lookups. If you’d rather confirm visually, Sysinternals Autoruns (from Microsoft’s own download page) has a Drivers tab that lists every boot-start driver currently registered. If vgk.sys shows up there after you’ve done all of the above, it means either a reboot is still pending or a reinstall attempt happened without you noticing.
Step 12: Confirm System Stability
If you got here chasing a blue screen, don’t call it fixed after one clean boot. Run the machine under normal load (games, background apps, whatever triggered the crash before) for at least a day or two, and check the reliability log:
perfmon /relThe Reliability Monitor shows a timeline of crashes and their causes. If vgk.sys stops appearing after the date you completed this cleanup, that confirms the driver (not a coincidental hardware issue) was the actual cause. If crashes continue with a different module named, the Vanguard removal worked but wasn’t the root problem, and it’s worth checking GPU drivers or Windows Update history separately.
Common Pitfalls
A handful of mistakes account for most repeat visits to this guide. Watch for these while you work through the steps above:
- Deleting the folder before deleting the services. This locks the driver file mid-uninstall and often leaves the registry keys behind, since the services never got a clean shutdown signal.
- Skipping the reboot between Step 4 and Step 5. A pending-deletion service can look gone in
sc queryand still hold the driver file locked, causing “Access is denied” on the folder delete. - Running Command Prompt without Administrator rights. Every
scandregcommand in this guide silently fails or throws Access Denied without elevation, always check the title bar says “Administrator.” - Leaving Riot Client installed and running at startup. It will reinstall Vanguard automatically the next time it launches, undoing the entire cleanup without any error message.
- Editing the wrong registry key.
CurrentControlSet\Servicesholds hundreds of entries. Triple-check the key name reads exactlyvgkorvgcbefore confirming any delete. - Assuming a blue screen with vgk.sys in the message is always Vanguard’s fault. A driver conflict with antivirus or GPU software can also reference vgk.sys indirectly, the Reliability Monitor check in Step 12 is there specifically to rule this in or out.
- Using a third-party force-uninstaller as the first move. These tools clear the Programs and Features entry but don’t reliably touch the kernel driver or registry keys, used alone, they leave you right back where you started.
Expected Output at Each Stage
Here’s what a clean run through this guide should look like at the key checkpoints, so you can tell early if something’s off track.
| Stage | Command | Expected output on success |
|---|---|---|
| Before cleanup | sc query vgk | STATE: 4 RUNNING or STATE: 1 STOPPED |
| After Step 3 | sc delete vgk | [SC] DeleteService SUCCESS |
| After reboot (Step 4) | sc query vgk | [SC] EnumQueryServicesStatus:OpenService FAILED 1060 |
| After Step 6 | reg query HKLM\...\Services\vgk | ERROR: The system was unable to find the specified registry key |
| Final check (Step 11) | Test-Path C:\Windows\System32\drivers\vgk.sys | False |
Troubleshooting Guide
If something in the process above didn’t go as expected, match your symptom to the list below.
| Symptom | Likely cause | Fix |
|---|---|---|
sc delete vgk returns ACCESS DENIED | Command Prompt not elevated | Close and reopen as Administrator, verify the title bar before retrying |
sc stop vgk fails with “cannot accept control messages” | Kernel drivers often can’t be stopped while loaded | Skip the stop, run sc delete vgk anyway, then reboot, deletion still takes effect after restart |
| Folder delete fails with “Access is denied” | Driver file still locked because no reboot happened after service deletion | Reboot first, then retry the folder delete |
| Vanguard reinstalls itself after you just removed it | Riot Client still installed and set to launch at startup | Remove Riot Client (Step 8) or disable its startup entry in Task Manager |
| Installed Apps still lists Riot Vanguard after full manual cleanup | Stale Programs and Features registry entry, unrelated to the driver itself | Use a force-removal utility (Step 10) as a final cleanup pass only |
| Blue screens continue after full removal | Vanguard wasn’t the actual cause, or a reboot is still pending | Check Reliability Monitor (Step 12) for the module named in the most recent crash |
Work or school laptop blocks sc delete with a policy error | Group Policy or MDM restricts local service management | You likely can’t complete this on a managed device, contact IT rather than working around the restriction |
reg delete reports the key was deleted, but reg query still finds it on next check | You edited the 32-bit registry view (WOW6432Node) instead of the native 64-bit path | Re-run from a native (not WOW64) elevated Command Prompt, or use regedit directly and navigate the real path |
Why This Shows Up More on Some Machines Than Others
Not every Valorant player who uninstalls the game runs into a stuck driver. The pattern tends to cluster around a few specific setups, and knowing which one applies to you can save a round of troubleshooting.
Machines with third-party antivirus or endpoint protection beyond Windows Defender see this more often, because some of those products intercept or quarantine driver files during install or removal, which can leave Windows and the antivirus disagreeing about whether vgk.sys is actually present. If you run something like a corporate EDR agent or an aggressive consumer antivirus suite, check its quarantine or blocked-items list before assuming the manual steps above didn’t work, the file may have been moved somewhere Task Manager and File Explorer don’t show by default.
Dual-boot systems and machines that were cloned or restored from a disk image are another common source of trouble. If Vanguard was installed before an image was captured, then the image was deployed to a second machine, both installations can end up referencing service registrations that don’t match the actual hardware, which produces exactly the kind of “installed but not really” state this guide addresses. If that’s your situation, run the full Steps 1 through 6 on the new machine even if Vanguard was never manually installed there, the registry can carry the mismatch over from the image.
Finally, machines that have gone through multiple Windows feature updates (for example, several 24H2-to-25H2-style upgrade cycles) without a clean reinstall accumulate more orphaned driver entries across every piece of software that’s ever touched the kernel, not just Vanguard. None of this means the driver itself is more dangerous on these systems, only that the removal is more likely to need the full manual process in this guide rather than a single click in Settings.
Advanced Tips
A few things worth knowing if you manage more than one machine, or want to avoid repeating this process later.
If you’re clearing Vanguard from several PCs (a household, a LAN setup, or a shared gaming PC) script the whole delete-and-verify sequence into a single batch file rather than typing commands on each machine. Save the following as remove-vanguard.bat and run it elevated on each target:
@echo off
sc stop vgc
sc stop vgk
sc delete vgc
sc delete vgk
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\vgk" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\vgc" /f
rmdir /s /q "C:\Program Files\Riot Vanguard"
echo Done. Reboot required before verifying.
pauseThis intentionally stops short of an automatic reboot. Force a restart inside an unattended script and you risk losing other open work on a shared machine, so leave that as a manual step the user confirms.
If Windows Defender Application Control or a similar allowlisting policy is active on the machine (common on managed corporate images), it may keep a record of Vanguard’s driver as a previously-trusted signed binary even after the file itself is deleted. That won’t cause problems on its own, but if you’re troubleshooting a WDAC policy violation unrelated to Vanguard, be aware the driver’s signature may still be referenced in policy logs until the next policy refresh.
Finally, if you plan to reinstall Valorant later, there’s no need to do anything special to prepare for it, Riot Client will recreate the vgc and vgk services fresh on next launch, and a clean prior removal (verified per Step 11) means that reinstall should go through without the “already installed” error that a partial removal usually causes.
Complete Working Removal Script
Putting every verified step together, here’s the full sequence from first check to final verification, meant to be run as a single elevated PowerShell session rather than pieced together manually:
# Step 1: Check current state
sc query vgc
sc query vgk
# Steps 2-3: Stop and delete services
sc stop vgc
sc stop vgk
sc delete vgc
sc delete vgk
# --- REBOOT MANUALLY HERE (Step 4) BEFORE CONTINUING ---
# Step 5: Remove program files
Remove-Item -Path "C:\Program Files\Riot Vanguard" -Recurse -Force -ErrorAction SilentlyContinue
# Step 6: Clear registry keys
Remove-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\vgk" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\vgc" -Force -ErrorAction SilentlyContinue
# Step 11: Verify
Write-Host "--- Verification ---"
Get-Service -Name vgc,vgk -ErrorAction SilentlyContinue
Write-Host "vgk.sys present:" (Test-Path "C:\Windows\System32\drivers\vgk.sys")
Write-Host "Vanguard folder present:" (Test-Path "C:\Program Files\Riot Vanguard")Run the first block, reboot, then run the second and third blocks in a fresh elevated session. Splitting it this way isn’t a style choice, the driver genuinely cannot be removed from a running session, so a script that tries to do it all in one shot without a restart in between will report success on the delete and then fail on the file removal.
How This Compares to Riot’s Official Steps
It’s worth being clear about what this guide adds versus Riot’s own uninstall documentation. Riot’s article covers the core sequence: elevated Command Prompt, sc delete vgc, sc delete vgk, reboot, then delete the folder. That’s correct and sufficient for a large share of users, and if you haven’t tried it yet, start there.
Where this guide differs is the failure cases Riot’s page doesn’t address: what to do when the registry keys survive that process anyway, how to approach a vgk.sys blue screen that prevents you from reaching a normal desktop long enough to run the commands, how to verify with certainty rather than by eyeballing File Explorer, and when a third-party force-removal tool is actually the right call versus a red flag that something else is wrong. Those are the scenarios that generate repeat support tickets and Reddit threads, and they’re the reason a clean uninstall on paper doesn’t always match what’s still running on disk.
For the underlying sc command syntax used throughout this guide, Microsoft’s own sc delete reference documents every flag and return code. If you want to dig further into a specific blue screen stop code, Microsoft’s bug check code reference lists what each one actually means at the driver level, and the Driver Verifier documentation covers a more aggressive diagnostic path if you suspect a different driver entirely is the real culprit.
Frequently Asked Questions
Is it safe to delete vgk.sys manually if sc delete didn’t remove it?
Yes, once the vgc and vgk services are deleted and the machine has been rebooted, the file itself should no longer be locked and can be deleted directly. If it’s still locked after a reboot, that means the service deletion didn’t fully register, go back and re-check with sc query vgk before forcing the file delete.
Will uninstalling Vanguard also uninstall League of Legends or other Riot games?
No. Removing Vanguard and Riot Client doesn’t touch other installed game files, but any other Riot title that also relies on Vanguard (League of Legends now uses the same anti-cheat) won’t launch until Vanguard is reinstalled.
Why does Vanguard reinstall itself even after I deleted everything?
Riot Client does this automatically if it’s still installed and configured to launch at startup. Uninstall Riot Client itself, or disable its startup entry, if you don’t want Vanguard reappearing.
Can leftover Vanguard registry keys cause problems beyond blocking reinstall?
Generally no, a stale service key under CurrentControlSet\Services that isn’t actively loading a driver doesn’t affect system performance or security on its own. It mainly causes confusion during reinstall attempts and shows up as clutter in tools like Autoruns.
Do I need Safe Mode for a normal uninstall, or only for the blue screen case?
Only for the blue screen case, where the crash prevents you from reaching a stable desktop. A stuck uninstaller with no crashes can be fixed entirely from a normal elevated Command Prompt session.
Is it normal for sc delete to succeed but sc query to still show the service right after?
Yes, this is expected. Windows marks the service for deletion but doesn’t remove it from the service control manager’s memory until the next reboot. Query again after restarting, not immediately after the delete command.
What if I’m on a work or school-managed laptop and sc delete is blocked?
That’s typically a Group Policy or MDM restriction preventing local service modification, and it’s there for a reason on a managed device. Don’t attempt to bypass it. Contact whoever manages the machine instead of running elevated commands the policy is specifically blocking.
Does Windows Defender Application Control (WDAC) interfere with removing Vanguard?
Not with the removal process itself. WDAC governs which signed binaries are allowed to run, not whether they can be deleted, so a system with WDAC policies active can still go through every step in this guide without modification, per Microsoft’s own WDAC documentation.
