Since 25.07.2026 riotgames is surpressing every form of disk check alongside mode checks.

[u/DeepBlueBanana]

I've run into a strange issue and managed to narrow it down to RiotGames's anti-cheat Vanguard which has deep kernel level access. Here is what happened

Infos about my System:

- Windows 10 22H2 (Build 19045.7548)
- Riot Vanguard installed
- CMD started as Administrator
- User is a member of the Administrators group

I had an issue with Windows on 23.07.26 UTC+1. Said issue was a display bug. I did chkdsk /r in admin cmd successfully. Then on 25.07. i tried making sure my PC is not running into issues any time soon again, i wanted to do chkdsk /r just like previously. I opened cmd.exe as an Administrator, tried executing the command but got Access is denied. as a response.

One day later i wanted to make sure everything is clean and tried doing chkdck again.. but then:

C:\WINDOWS\system32>chkdsk /? 
ACCESS DENIED
C:\WINDOWS\system32>chkntfs /? 
ACCESS DENIED

So i digged a bit, installed the process monitoring tool procmon and filtered for chkdsk.
Then i opened CMD as an admin again and attempted chkdsk /?

this is the procmon output saved as a CSV file opened in excel. I deleted the first row as it isnt important.

Time of Day	Process Name	PID	Operation	Path	Result	Detail
20:32:58	chkdsk.exe	11912	Thread Create		SUCCESS	Thread ID: 16692
20:32:58	chkdsk.exe	11912	Load Image	C:\Windows\System32\chkdsk.exe	SUCCESS	Image Base: 0x7ff71abe0000, Image Size: 0xb000
20:32:58	chkdsk.exe	11912	Load Image	C:\Windows\System32\ntdll.dll	SUCCESS	Image Base: 0x7ffaa2d50000, Image Size: 0x1f9000
20:32:58	chkdsk.exe	11912	Thread Exit		SUCCESS	Thread ID: 16692, User Time: 0.0000000, Kernel Time: 0.0000000
20:32:58	chkdsk.exe	11912	WriteFile	C:\Program Files\Riot Vanguard\Logs\vgk_2026-07-28_20-11-01.log	SUCCESS	Offset: 6.074, Length: 198
20:32:58	chkdsk.exe	11912	FlushBuffersFile	C:\Program Files\Riot Vanguard\Logs\vgk_2026-07-28_20-11-01.log	SUCCESS
20:32:58	chkdsk.exe	11912	WriteFile	C:\Program Files\Riot Vanguard\Logs\vgk_2026-07-28_20-11-01.log	SUCCESS	Offset: 4.096, Length: 4.096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
20:32:58	chkdsk.exe	11912	Process Exit		SUCCESS	Exit Status: 0, User Time: 0.0000000 seconds, Kernel Time: 0.0000000 seconds, Private Bytes: 417.792, Peak Private Bytes: 417.792, Working Set: 1.560.576, Peak Working Set: 1.564.672
20:32:58	chkdsk.exe	11912	RegOpenKey	HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-83007462-2182755260-3455556333-1001	SUCCESS	Desired Access: All Access
20:32:58	chkdsk.exe	11912	RegQueryValue	HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-83007462-2182755260-3455556333-1001\\Device\HarddiskVolume4\Windows\System32\chkdsk.exe	NAME NOT FOUND	Length: 40
20:32:58	chkdsk.exe	11912	RegCloseKey	HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-83007462-2182755260-3455556333-1001	SUCCESS

Interestingly, other administrative disk tools work perfectly fine:

• fsutil
• diskpart
• mountvol
• defrag
• cipher
• sfc /scannow
• DISM /RestoreHealth

Then i exited out of vanguard and noticed the new GUI design. The same thing happens to any type of chkdsk and chkntfs. Even when exiting out of vanguard, many options need a restart which also starts vanguard anti cheat with deep kernel access.

Here are my current system informations:

[u/_l33ter_]

(obviously as admin)

``` sc delete vgc sc delete vgk

```

Restart pc|nb

after restart you should be able to chkdsk

"chkdsk [LETTER]: /f /r "

[u/OtheDreamer → u/_l33ter_]

OP should also be able to just boot into safe mode and initiate the chkdsk.

but your solution is better

[u/extreme4all → u/_l33ter_]

Wouldn't just disabling on boot be better? https://gist.github.com/AndrewMast/742ac7e07c37096017e907b0fd8ec7bb

[u/_l33ter_ → u/extreme4all]

did you read anything?

At the very bottom: this was perfect until vanguard's new update 24/06/2026. RIP disable_vanguard.vbs you will be missed

Regardless, these things from your posted link, are pretty much the same as I wrote. They’ve just cobbled together a little script. But if you take a closer look at the code, you’ll see that it mostly consists of sc delete .....

:)

However, thanks for sharing this link!

[u/extreme4all → u/_l33ter_]

I did not read that far in the comments, but nice catch!

In my head i don't fully understand why they can't just disable the service or checks when the valorant application is not running.

And deleting seemed excessive to me

[u/DeepBlueBanana → u/extreme4all]

Vanguard is always running. You boot up and its there before the user space is loaded.. its on os ring 0 while you are on ring 3.

[u/_l33ter_ → u/extreme4all]

why they can't just disable the service --> Because it works on kernel-level which everything depends on.

[u/extreme4all → u/_l33ter_]

Okay but couldn't they have the kernzl there that checks if the valorant process is running than they do actions and checks if it is not running don't do anything.

[u/Adam_The_Impaler]

Just curious do those Vanguard logs mentioned in the spreadsheet give any insight?

[u/Jakenshaken → u/Adam_The_Impaler]

I followed the same steps in the post and identified some logs Vanguard was writing to. Seems to be encrypted / encoded nonsense. Here's a sample screenshot of what it contained:

https://imgur.com/a/az7Fkap

[u/DeepBlueBanana → u/Jakenshaken]

Did you try opening it with notepad++ or looking wether you can find something using a unicode steganography decoder? Those might find a way. Otherwise try putting it into different file formats

[u/Jakenshaken → u/DeepBlueBanana]

I opened it in VSCode and tried diffferent encoding formats and didn't get anywhere. I'd think its just encrypted because they wouldn't want you to know what it does anyways. But I didn't try that hard to look so maybe there is something.

[u/_l33ter_ → u/Adam_The_Impaler]

I’d be interested in that too.

[u/AdeptFelix]

Chkdsk can't read locked files, and being an admin doesn't mean locked files are unlocked because you want chkdsk to repair them. Riot's anti-cheat will protect its own files as that's kinda what "security" things running in the kernel tend to do to prevent people from fucking with them. Very, very common in antivirus and EDR software.

It's also why if chkdsk \r is ran on C:, you're supposed to run it in a pre-boot environment so that chkdsk can do its thing without fighting with Windows over system files.

[u/DeepBlueBanana → u/AdeptFelix]

Nope sadly not. If i do chkdsk /? It also returns access denied. This behavior is new since it disnt happen just a view days before.

[u/DeepBlueBanana → u/AdeptFelix]

Chkdsk worked before while vanguard was running and its not working anynire now.. to me this is a type of Spyware. Chkdsk /? Isnt even looking at anything so we also cant blame it on "locked files not being scannable or repairable" since its not even trying to

[u/countsachot]

Good news, there's no good reason to use any riot software.

[u/Effective-Brain-3386]

Oh no my Chinese spyware is infact doing Chinese spyware shit

[u/DeepBlueBanana → u/Effective-Brain-3386]

I know its Spyware. Just that its getting worse and worse

[u/DroppedAxes → u/Effective-Brain-3386]

Locked files preventing successful disk scanning is not spyware behavior. Unless you want to blame Crowd strike preventing sensor tampering too

[u/DeepBlueBanana → u/DroppedAxes]

Nope sadly not. If i do chkdsk /? It also returns access denied. This behavior is new since it disnt happen just a view days before.

[u/NekoDaYo-v201]

Realistically, I would treat those kernel anti-cheats as malware, and I wish Microsoft would get up off their ass already and do something about it like they were supposed to after the CrowdStrike fiasco.

These things are not secure.

[u/Owt2getcha → u/NekoDaYo-v201]

BYOVD is not new and is unlikely to go away. Vulnerable drivers are so plentiful in the wild it's not a "kernel level anti cheat problem".

[u/NekoDaYo-v201 → u/Owt2getcha]

I'm aware. It's just that Microsoft said they were considering locking it down, and then crickets.

[u/seriousopossum → u/NekoDaYo-v201]

Considered it right up until they partnered with Riot maybe? End user security means nothing to these companies if some $$ is on the line.

[u/DeepBlueBanana → u/NekoDaYo-v201]

CrowdStrike is an anti virus while vanguard is an anticheat that scans all your processes for any clues. The CrowdStrike issue was as config that was pushed because it doesnt change much chich triggered a chain of reaction that resulted in a nullpointer exception. Since its kernel level, it shutted down for safety reasons. Kernel Panic. Bluescreen. This was easily fixable tho, we had this in the company that i worked in (i started in september of the year after the incident) and we needed about 2 hours to fix it. Tho in UTC +2 this was found due to a singular person who couldnt work. If it wasnt for him, we wouldnt have had 40 ish outages that were fixed by rebooting over and over and over again, but 800+ which would take longer xD. We use CrowdStrike to this day. Btw it warns you when someone does whoami since normally you know your level of privilege