Vanguard Still There? Verify Uninstall in 12 Steps [2026]

Riot Games support threads and forum posts describe a familiar scene. A player runs the Valorant uninstaller, restarts the PC, and assumes Vanguard is gone. Then Task Manager tells a different story, or a fresh install attempt fails because a leftover registry key or a locked driver file is still sitting on the disk. This piece is not about how to click through the uninstaller. The site already has practical guides for that, including a step-by-step Valorant removal walkthrough and a fix list for when the uninstall gets stuck. This is about proving the removal actually worked.

That distinction matters more in 2026 than it used to. Riot shipped Vanguard On-Demand in June 2026, a mode that stops the kernel driver from loading at boot on secured Windows 11 machines, according to Tom’s Hardware. It is a real security improvement, but it also changes what “installed” looks like on disk, which makes a quick glance at the Programs list an unreliable way to confirm removal. If you are prepping a PC for resale, handing a laptop to a family member, or just tired of guessing, you need an audit, not a hunch.

This tutorial builds that audit from scratch. You will write a PowerShell script that checks every location Vanguard is known to leave a trace: services, the kernel driver file, registry keys, scheduled tasks, and leftover data folders. By the end you will have a script that prints a clear pass or fail report, one you can save as evidence before wiping a drive or handing over a machine.

Why “Uninstalled” Doesn’t Always Mean Gone

Vanguard is not a normal application. It ships a kernel-mode driver, historically named vgk.sys, that runs at the same privilege level as Windows itself. A standard uninstaller can remove the game client, delete shortcuts, and still leave the driver’s service entry and binary behind, because kernel drivers do not always unload cleanly while Windows is running. A community thread on r/ValorantTechSupport documented exactly this problem: two orphaned services, vgc and vgk, kept the driver file locked and blocked a clean reinstall until the poster manually stopped and deleted both services with the Service Control utility.

The practical effect is that “Valorant is uninstalled” and “Vanguard is uninstalled” are two different claims. You can remove the game and still have a resident kernel driver, an active service, or a stray registry hive pointing at files that no longer exist. Our guide to removing the Vanguard driver covers how to force that cleanup when the standard path fails. This article picks up after that step. It gives you a way to check your work instead of trusting that the job is done.

There is also a privacy angle that gets less attention. Vanguard’s install directories and logs can hold data tied to your hardware and play history. If you are selling a PC or donating it, a partial removal leaves that data behind for the next owner to find, whether or not the driver itself is still active.

Prerequisites: What You Need Before You Start

Nothing here requires third-party software, though one optional tool makes cross-checking easier. Confirm the following before you open a terminal.

Requirement	Minimum Version	Why It Matters
Windows edition	Windows 10 21H2 or Windows 11 22H2+	Vanguard’s service and driver paths are consistent across these builds
PowerShell	PowerShell 5.1 (built in) or PowerShell 7.4+	Both run the script; 7.4 adds faster cmdlets and better error objects
Account privileges	Local Administrator	Reading driver services and some registry hives requires elevation
Free disk space	None required	The audit only reads state, it does not write large files
Optional: Sysinternals Autoruns	Latest release from Microsoft	Useful for a second opinion on boot-time drivers and services
Time	About 15 to 20 minutes	Covers writing, running, and reviewing the audit script

You do not need Valorant installed to run this audit. In fact, the whole point is to run it after you believe Valorant and Vanguard are both gone, to confirm the belief is correct. If you are on PowerShell 5.1 and want the newer engine, PowerShell 7.4+ installs side by side without touching the built-in version, and every command in this guide runs the same way on both. There is no functional requirement to upgrade, the built-in version handles all of the checks below without issue, so treat the newer engine as a convenience rather than a dependency.

Understanding How Vanguard Installs Itself on Windows

Before you can verify removal, you need to know exactly what Vanguard touches. It writes to four categories of Windows state, and a thorough audit checks all four rather than stopping at the first clean result.

The vgk.sys Kernel-Mode Driver

The driver file lives at C:\Windows\System32\drivers\vgk.sys and is registered as a Windows service named vgk under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Because it runs in kernel mode, Windows can keep it resident in memory until the next reboot even after its service registration is deleted, so a restart is a required part of any verification, not an optional step.

The vgc User-Mode Service and Riot Vanguard Folder

Alongside the kernel driver, Vanguard installs a user-mode service called vgc and a program folder at C:\Program Files\Riot Vanguard. This folder can survive a standard uninstall even when the services are removed cleanly, which is one reason bulk removal tools exist. Our bulk-uninstall walkthrough handles the case where you want to strip both the game and the anti-cheat in one pass, but it still benefits from a follow-up audit to confirm nothing survived the process.

Telemetry Logs and Scheduled Repair Tasks

Two categories of leftovers get overlooked even by people who remember to check services and folders. The first is telemetry and crash logs, which Vanguard writes to C:\ProgramData\Riot Games during normal play and does not always clear during uninstall. These files are small individually, but they can carry hardware identifiers and session timestamps, which matters if your goal is a clean handoff rather than just a working reinstall. The second is a scheduled task some builds register to repair or reinstall Vanguard components automatically. If that task survives a manual cleanup, it can silently reintroduce the service the next time you log in, which is exactly the kind of result that makes a one-time visual check unreliable and an actual audit worth the extra five minutes.

What Changed With Vanguard On-Demand in 2026

Riot’s on-demand mode, rolled out through 2026 on machines that meet Windows 11’s secured-core requirements, loads vgk.sys only when a Riot game launches and unloads it when the game closes. That is a meaningful shift away from a driver that used to sit resident at every boot. The change relies on a Windows 11 25H2 capability called Runtime Driver Attestation, which continuously records the hash of every driver loaded since startup into the machine’s TPM, so Vanguard can retroactively verify no untrusted driver ran earlier in the session, even without staying loaded itself. Microsoft documents the underlying TPM attestation model in its Trusted Platform Module overview.

For your audit, this means a machine running the on-demand build might show a stopped vgk service most of the time, and that is normal, not evidence of a botched uninstall. What matters is whether the service and driver still exist after you have actually removed Valorant, not whether they were running at the moment you checked. Our earlier report on Vanguard’s rocky path to becoming optional covers how Riot got here, including the device-bricking complaints that pushed the change.

Does Riot’s Own Uninstaller Already Verify Removal?

Riot’s official documentation, available through Riot’s Valorant support hub, walks players through the standard uninstall path using Windows Settings or Control Panel. It does not include a built-in verification step, and there is no official Riot tool that scans the registry or driver store afterward to confirm the anti-cheat is fully gone. That gap is not unusual. Most software vendors treat “uninstall completed without an error message” as success, even when kernel-level components are involved, and Vanguard is far from the only anti-cheat with that blind spot.

The gap matters more for Vanguard than for most software because of what the driver is designed to do. Vanguard’s entire job is to detect tampering at the kernel level, which means it necessarily has deep hooks into the operating system that a simple file-delete-and-forget uninstaller was never built to unwind cleanly. Riot has acknowledged the tradeoff publicly through the rollout of Vanguard On-Demand, which reduces how long the driver stays resident but does not change how thoroughly the standard uninstaller cleans up after itself once you have removed the game. That is the reason an independent audit, one you control and can rerun any time, is worth the fifteen minutes it takes to set up rather than trusting a green checkmark in the uninstall wizard.

Step 1-3: Set Up Your Audit Environment

Step 1: Open PowerShell as Administrator. Right-click the Start button, choose Terminal (Admin) on Windows 11 or PowerShell (Admin) on Windows 10. Reading service and driver registrations under HKLM\SYSTEM fails silently without elevation, so skipping this step produces false negatives rather than errors, which is worse.

Step 2: Confirm your execution policy allows a local script to run. Most systems default to RemoteSigned, which is fine for a script you write yourself, but it is worth checking before you save anything to disk.

Get-ExecutionPolicy -List
# If Process/CurrentUser show Restricted, allow this session only:
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force

Step 3: Create a working folder for the audit script and its logs. Keeping the report alongside the script makes it easy to attach the output to a support ticket or keep as a pre-sale record.

New-Item -ItemType Directory -Path "$env:USERPROFILE\VanguardAudit" -Force | Out-Null
Set-Location "$env:USERPROFILE\VanguardAudit"

Step 4-6: Audit Services and the Kernel Driver

Step 4: Query the two Vanguard services directly. Get-Service returns a clean error object instead of throwing if the service does not exist, which is exactly the result you want to see.

Get-Service -Name vgc,vgk -ErrorAction SilentlyContinue |
    Select-Object Name, DisplayName, Status, StartType

An empty result here is a good sign, but it is not the whole picture. A service can be deleted from the Service Control Manager’s active list while its driver file and registry key still exist on disk, so the next two steps matter just as much.

Step 5: Check whether the driver file itself is still present.

$driverPath = "$env:WINDIR\System32\drivers\vgk.sys"
if (Test-Path $driverPath) {
    Write-Warning "vgk.sys still exists at $driverPath"
} else {
    Write-Output "vgk.sys not found - driver file is clear"
}

Step 6: Cross-check with the older Service Control command line tool. It occasionally surfaces entries that PowerShell’s cmdlets miss on older builds, so a second query costs nothing and catches edge cases.

sc.exe query vgk
sc.exe query vgc

If either command returns “The specified service does not exist as an installed service,” that entry is genuinely gone. Any other response, including an access-denied error, means you need to dig further before declaring victory.

Step 7-9: Audit Registry and Filesystem Remnants

Step 7: Query the registry keys behind both services. These keys control startup type and driver load order, and stale entries here have been reported to block clean reinstalls.

reg query "HKLM\SYSTEM\CurrentControlSet\Services\vgk"
reg query "HKLM\SYSTEM\CurrentControlSet\Services\vgc"

Step 8: Sweep the known installation and data folders. Vanguard and the wider Riot Client ecosystem write to several paths, and any of them can survive a partial uninstall.

$paths = @(
    "C:\Program Files\Riot Vanguard",
    "C:\Program Files\Riot Games",
    "C:\Program Files (x86)\Riot Games",
    "C:\ProgramData\Riot Games"
)
foreach ($p in $paths) {
    if (Test-Path $p) {
        $size = (Get-ChildItem $p -Recurse -ErrorAction SilentlyContinue |
            Measure-Object -Property Length -Sum).Sum / 1MB
        "{0} - FOUND - {1:N1} MB" -f $p, $size
    } else {
        "{0} - clear" -f $p
    }
}

Step 9: Check for the software registry hive Riot Games writes on install. If this key still lists Vanguard, that is a strong signal the uninstaller never finished cleanly.

Get-ChildItem "HKLM:\SOFTWARE\Riot Games" -ErrorAction SilentlyContinue |
    Select-Object PSChildName

If you also want the Riot Client itself gone, not just Vanguard, our Riot Client removal guide walks through the client-specific paths this step does not cover, including the login cache and patch files.

Step 10-12: Build the Automated Audit Script (Complete Working Project)

Step 10: Combine every check above into a single script that produces one verdict. Save this as Verify-VanguardRemoval.ps1 inside the folder you created in Step 3. It checks services, the driver file, registry keys, scheduled tasks, and data folders, then prints a pass or fail summary along with a saved log.

#Requires -RunAsAdministrator
$ErrorActionPreference = "SilentlyContinue"
$findings = @()

# 1. Services
$svc = Get-Service -Name vgc,vgk -ErrorAction SilentlyContinue
if ($svc) { $findings += "Service(s) present: $($svc.Name -join ', ')" }

# 2. Kernel driver file
$driverPath = "$env:WINDIR\System32\drivers\vgk.sys"
if (Test-Path $driverPath) { $findings += "Driver file present: $driverPath" }

# 3. Registry service keys
foreach ($key in "vgk","vgc") {
    if (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Services\$key") {
        $findings += "Registry service key present: $key"
    }
}

# 4. Riot Games software registry hive
if (Test-Path "HKLM:\SOFTWARE\Riot Games") { $findings += "Registry hive present: HKLM\SOFTWARE\Riot Games" }

# 5. Install and data folders
$paths = @(
    "C:\Program Files\Riot Vanguard",
    "C:\Program Files\Riot Games",
    "C:\Program Files (x86)\Riot Games",
    "C:\ProgramData\Riot Games"
)
foreach ($p in $paths) {
    if (Test-Path $p) { $findings += "Folder present: $p" }
}

# 6. Scheduled tasks (Vanguard registers a repair task on some builds)
$tasks = Get-ScheduledTask -ErrorAction SilentlyContinue |
    Where-Object { $_.TaskName -match "Vanguard|Riot" }
if ($tasks) { $findings += "Scheduled task(s) present: $($tasks.TaskName -join ', ')" }

# Report
$timestamp = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
$logPath = ".\VanguardAudit_$timestamp.txt"

if ($findings.Count -eq 0) {
    "PASS - No Vanguard residuals detected at $(Get-Date)" | Tee-Object -FilePath $logPath
} else {
    "FAIL - Vanguard residuals detected at $(Get-Date):" | Tee-Object -FilePath $logPath
    $findings | ForEach-Object { $_ | Tee-Object -FilePath $logPath -Append }
}

Step 11: Run the script and read the exit summary.

.\Verify-VanguardRemoval.ps1

Step 12: Reboot and run the script a second time. This catches the kernel driver case described earlier, where vgk.sys can stay loaded in memory until restart even after its service entry is deleted. A PASS result before reboot and a PASS result after reboot is the only combination that counts as a confirmed clean removal.

Auditing a Shared or Family PC: What Changes

Everything above assumes a single-user machine, but Vanguard’s driver and service entries are machine-wide, not tied to one Windows account. On a shared or family PC, that has two practical consequences worth planning for before you run the script.

First, the kernel driver and services checked in Steps 4 through 7 will show up regardless of which account installed Valorant, so a PASS result confirms the whole machine is clear, not just your profile. Second, per-user data can still exist under other accounts even after the machine-wide components are gone. Riot Client login tokens and local match history are typically written to each user’s %LOCALAPPDATA% folder, which the audit script above does not scan because it is designed to check system-wide state that a standard user account cannot always read on someone else’s profile.

If you are handing the PC to a new owner and multiple people played Valorant on it, log into each account once with an administrator token and run this quick supplemental check before your final audit pass.

Get-ChildItem "C:\Users\*\AppData\Local\Riot Games" -ErrorAction SilentlyContinue |
    Select-Object FullName

Any path this returns is a per-user folder that survived, and it should be deleted separately from the machine-wide cleanup covered in Steps 8 and 9. Keep in mind that deleting another user’s AppData folder requires administrator rights and, on some Windows configurations, taking ownership of the folder first, since Windows locks per-profile data against other standard accounts by default.

Reading the Audit Output: What Pass and Fail Look Like

A clean system produces a single line and nothing else.

PASS - No Vanguard residuals detected at 09/04/2026 14:22:07

A system with leftovers lists every location the script found, which doubles as a to-do list for manual cleanup. If you plan to call this script from a larger automation pipeline, wrap the result in an exit code rather than relying on parsing the printed text, since text output is easy to accidentally break with a formatting change later.

# Append to the end of the script for automation-friendly exit codes
if ($findings.Count -eq 0) { exit 0 } else { exit 1 }

FAIL - Vanguard residuals detected at 09/04/2026 14:22:07:
Service(s) present: vgc
Registry service key present: vgc
Folder present: C:\ProgramData\Riot Games

Signal Checked	Clean System	Vanguard Still Present
vgk / vgc services	Get-Service returns nothing	Status shown as Stopped or Running
vgk.sys driver file	Test-Path returns False	Test-Path returns True
Registry service keys	Path does not exist	Key exists under CurrentControlSet\Services
Riot Vanguard folder	Test-Path returns False	Folder exists, often 40-80 MB
HKLM\SOFTWARE\Riot Games hive	No child keys returned	Vanguard-related subkeys listed
Scheduled tasks	No matching task names	Repair or update task still registered

Common Pitfalls When Verifying Vanguard Removal

Most audit failures trace back to one of a handful of habits rather than anything unusual about the specific machine. The list below covers the mistakes that show up most often, roughly in order of how frequently they trip people up the first time they try this.

• Running the audit without administrator rights. Several of these checks fail silently or return empty results under a standard user token, which produces a false PASS instead of an error you would notice.
• Checking immediately after uninstall without rebooting. The kernel driver can stay resident in memory until restart, so a pre-reboot PASS on the driver check is not conclusive by itself.
• Treating a stopped service as a removed service. On Vanguard On-Demand builds, vgk sitting in a Stopped state is normal during idle time and does not mean removal failed, but the service still needs to be gone entirely, not just inactive, once you have actually uninstalled the game.
• Only checking the Program Files folder. Riot writes to ProgramData and the registry independently of the install directory, and skipping those locations is the most common reason a “clean” uninstall still leaves data behind.
• Assuming Task Manager or the Programs list is authoritative. Neither tool inspects kernel drivers or registry service entries, so a game that no longer appears in Settings can still have Vanguard artifacts on disk.
• Deleting the driver file manually while its service still exists. Removing vgk.sys without first stopping and deleting the vgk service can leave a registry entry pointing at a file that no longer exists, which sometimes breaks a future reinstall in a different way.
• Ignoring per-user folders on a shared machine. The machine-wide checks in this guide catch the driver, services, and system folders, but login tokens and match history stored under an individual account’s AppData folder need a separate pass, covered in the shared-PC section above.
• Forgetting that antivirus quarantine can hide a driver, not remove it. Some security tools flag vgk.sys during install conflicts and move it to quarantine rather than deleting it outright. A quarantined file will not show up under Test-Path, which can produce a false PASS if the antivirus later restores it automatically.

Troubleshooting: When the Audit Finds Leftovers

A FAIL result is not a dead end, it is a map. Every finding the script prints maps directly to one of the checks you ran manually in Steps 4 through 9, which means you already know which command exposed the problem and which cmdlet can clear it. The table below covers the nine leftover scenarios reported most often by people running this kind of audit after a Valorant uninstall, ranked roughly by how frequently each one shows up in support threads and forum reports.

Symptom	Likely Cause	Fix
Script reports “Access Denied” on service checks	PowerShell not running elevated	Close and reopen as Administrator, then rerun
vgc service present but Status shows Stopped	Vanguard On-Demand mode, not a failed uninstall	Confirm Valorant itself is actually uninstalled before treating this as an error
vgk.sys file present after service deletion	Kernel driver still loaded in memory	Reboot, then rerun the audit before deleting the file manually
Registry key exists but service does not	Partial uninstall left an orphaned key	Delete the key with Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\vgk" -Recurse after confirming the service is gone
Riot Vanguard folder won’t delete, “in use” error	A related process or driver handle is still active	Reboot into Safe Mode or stop the service first, then retry deletion
Scheduled task for Vanguard reappears after deletion	Task was recreated by a leftover Riot Client component	Uninstall the Riot Client fully, then delete the task again
Audit script won’t run, “not digitally signed” error	Execution policy blocking local scripts	Run Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass for that session only
Get-ScheduledTask returns no results at all, even for known tasks	Task Scheduler service is stopped	Run Start-Service Schedule then rerun the audit
HKLM\SOFTWARE\Riot Games still lists old entries after full uninstall	32-bit registry redirection hiding the real key	Also check HKLM:\SOFTWARE\WOW6432Node\Riot Games

Advanced Tips: Scheduling Recurring Audits and Pre-Sale Certification

If you manage more than one PC, or you want a standing check that runs after every game uninstall, register the script as a scheduled task instead of running it manually each time.

schtasks /create /tn "VanguardAudit" /tr "powershell.exe -File C:\Users\%USERNAME%\VanguardAudit\Verify-VanguardRemoval.ps1" /sc onlogon /rl highest

For pre-sale documentation, extend the script’s output to JSON so it can be attached to a listing or a hand-off checklist without manual formatting.

@{
    Timestamp = (Get-Date).ToString("o")
    Result = if ($findings.Count -eq 0) { "PASS" } else { "FAIL" }
    Findings = $findings
} | ConvertTo-Json | Out-File ".\VanguardAudit_$timestamp.json"

For a second, independent opinion on boot-time drivers, run Microsoft’s Sysinternals Autoruns and filter the Drivers tab for anything matching “Vanguard” or “vgk.” Cross-checking a script you wrote yourself against an external tool is good practice, not paranoia, especially before you erase a drive for resale. Microsoft’s own guidance on endpoint hardening covers similar cross-verification habits on its Microsoft Security Blog.

How Often Should You Re-Run the Audit?

For a one-time uninstall, running the script twice, once before reboot and once after, is enough. For anyone who reinstalls and removes Valorant repeatedly, whether that’s a shared gaming PC, a QA machine testing anti-cheat compatibility, or a computer that gets passed between household members, a recurring schedule catches drift that a single check would miss.

A weekly run through the scheduled task shown below is enough to catch the two failure modes that actually happen over time: a repair task silently reinstalling the service, or a Windows update resetting a driver’s startup type. Both are rare, but they are also exactly the kind of thing a visual check will never catch, since nothing in the Programs list or Task Manager changes when a background service quietly reappears.

If you are running this on a machine you are about to sell, treat the last audit before wiping the drive as the one that counts. Save its JSON output alongside your sale listing or hand-off paperwork so there is a timestamped record showing the state of the machine when it changed hands, not just your word that you checked.

Vanguard Verification vs Other Kernel-Level Anti-Cheat Systems

Vanguard is not the only kernel-level anti-cheat that can leave orphaned services behind. Easy Anti-Cheat and BattlEye both ship driver components for the games that use them, and both have documented cases of services surviving a game’s uninstall. The table below summarizes the practical differences you will run into if you are auditing a machine that has played more than one anti-cheat-protected title.

System	Driver Persistence	Typical Leftover Risk
Riot Vanguard	Boot-time by default, on-demand on secured Windows 11 PCs since mid-2026	Service, driver file, registry hive, and ProgramData folder
Easy Anti-Cheat	Per-game, loads with the specific title	Shared service can remain if multiple EAC-protected games are installed
BattlEye	Per-game, loads with the specific title	Service folder under Program Files can survive individual game removal

The audit workflow in this guide generalizes to those systems too. Swap the service names and paths in Steps 4 through 9 for the anti-cheat you are checking, and the same logic applies: services first, then the driver file, then the registry, then scheduled tasks and data folders.

Vanguard’s boot-time default has historically drawn more criticism than EAC or BattlEye specifically because it used to load regardless of whether a Riot game was running, while the other two only activate when their protected title launches. That difference is also why Vanguard’s move to on-demand loading in 2026 counts as a bigger structural change than a routine patch. It brings Riot’s behavior closer to how competing anti-cheat systems have worked for years, without giving up the kernel-level detection that makes Vanguard effective against the cheats it is built to catch.

Keeping Vanguard Removal Separate From a Broken Reinstall

One reason to run this audit before troubleshooting a failed reinstall is that the two problems look identical from the outside. If Valorant refuses to install and your audit script reports FAIL with leftover services or registry keys, the fix is cleanup, not a fresh download. If the audit reports PASS and the install still fails, the cause is somewhere else entirely, likely networking, disk permissions, or a corrupted patch cache. Running the audit first saves you from reinstalling Valorant three times while the actual blocker sits untouched in the registry.

This is also where a scheduled or repeated audit earns its keep. If a PASS result later flips to FAIL without you installing anything, that is a signal worth investigating on its own, since Vanguard components generally do not reappear on a clean machine without a new install triggering it. In practice, the two most common triggers for that kind of unexpected flip are a Windows feature update that restores a driver entry from a system restore point, or a family member reinstalling Valorant under a different account without telling you. Either way, the audit script tells you something changed even when nothing on the desktop looks different, which is the entire reason to prefer a script over a habit of eyeballing the Programs list.

FAQ

Does uninstalling the Riot Client also remove Vanguard?

Not automatically. Vanguard installs as a separate service and driver from the Riot Client, so removing the client does not guarantee the anti-cheat components are gone. Run the audit script after removing both to confirm.

Is it normal for the vgc service to show up even after I uninstalled Valorant?

No. If Valorant is fully uninstalled, the vgc and vgk services should not exist at all, not just be stopped. A present-but-stopped service after a genuine uninstall points to leftover registration rather than the normal on-demand behavior.

Why does the audit need a reboot to be conclusive?

Because vgk.sys runs in kernel mode, Windows can keep it loaded in memory until the next restart even after its service entry has been deleted. Checking before and after reboot is the only way to catch that case.

Can I run this audit script without installing anything extra?

Yes. Everything in this guide uses cmdlets built into Windows PowerShell, documented in Microsoft’s PowerShell scripting reference. The optional Sysinternals Autoruns cross-check is the only third-party addition, and it is free from Microsoft.

Will this audit flag Vanguard On-Demand as a failed uninstall?

Only if you run it while Valorant is still installed. On-demand mode still registers the service and driver, it just does not load them at boot. The audit checks for presence of the service and files, not whether they are actively running, so it correctly distinguishes “installed but idle” from a genuine removal once you have actually uninstalled the game.

What should I do if the audit still shows FAIL after multiple cleanup attempts?

Check the 32-bit registry redirect at HKLM:\SOFTWARE\WOW6432Node\Riot Games, confirm the Task Scheduler service is running so scheduled task checks work correctly, and consider contacting Riot’s official Valorant support if a specific file remains locked across reboots.

Is it safe to delete the vgk.sys file manually?

Only after you have confirmed the vgk service is fully deleted and the machine has been rebooted. Deleting the file while the service registration still points to it can leave the system in a worse state than before, with a registry entry referencing a missing driver.

Does this audit work on Windows 10 as well as Windows 11?

Yes. The service, registry, and folder checks are identical across both. The one difference is that Vanguard On-Demand mode is only available on Windows 11 builds that meet the secured-core requirement, so on Windows 10 you should expect the driver to always register for boot-time loading whenever Valorant is installed.

Does antivirus software interfere with this audit?

It can, but usually not with the audit itself, only with the cleanup that follows it. Some antivirus products quarantine vgk.sys during install conflicts rather than deleting it, which means the file can reappear later if the antivirus restores it from quarantine automatically. If your audit flips from PASS back to FAIL without a new Valorant install, check your antivirus quarantine log before assuming Vanguard reinstalled itself.

Should I run this audit before or after using a third-party uninstaller tool?

After. Third-party uninstallers can remove the visible application while missing kernel-level services, so the audit is most useful as a final check regardless of which removal method you used. Running it before and after a third-party tool also gives you a clear before-and-after comparison if you want to confirm the tool actually did what it claimed.

Can I adapt this script to check for other anti-cheat systems like Easy Anti-Cheat or BattlEye?

Yes, and the structure barely changes. Replace the service names vgc and vgk with the target system’s service names, update the driver file path and install folders, and the same services-then-driver-then-registry-then-tasks logic applies. Easy Anti-Cheat and BattlEye both register comparable Windows services, so the audit pattern in this guide transfers directly once you know which names and paths to swap in.

Related Coverage

• Bulk-Uninstall Valorant & Vanguard: 12 Steps, 45 Min [2026]
• How to Uninstall Riot Client Completely: 12 Steps [2026]
• Valorant Won't Uninstall: 12 Fixes for Vanguard [2026]
• Remove Vanguard Anti-Cheat After Uninstalling Valorant: 10 Steps [2026]
• How to Uninstall Valorant Completely: 10 Steps [2026]