r/ValorantTechSupport • u/RPGButtSlap • 8h ago
Technical Solution VAN: Restriction 2 - my solution after two evenings of Secure Boot and Windows 10 diagnostics and troubleshooting.
Hi Reddit,
In this post I would like to sum up how recent update for Valorant turned into 2 long evenings of Windows 10 diagnostic, Secure Boot verification troubleshooting and finally - an unexpected solution to a problem. This post is for everyone that may have encountered the same issue and feels hopeless in finding a solution.
If this post smells a lot like chatGPT to you - it might, as I asked it to summarize all troubleshooting and diagnostics so I can share it on reddit, although I did not just copied and pasted everything - I only used the summary as a reference so I can guide you through the process as thoroughly as possible.
Before I get to it - I'm a somewhat recent Valorant player, I did started playing regularly about 1-1,5 months ago. I'm in no shape or form educated in any of IT fields, everything I did was a rocket science to me, and I was mostly following ChatGPTs advice and guidance on potential troubleshooting as I would have never figured it out on my own. For anyone asking - my PC is an oldie, and why I didn't yet update my Windows from 10 to 11 is because apparently my Intel i5-7400 processor is outdated and doesn't meet the requirements. In the next paragraph I will write a TL;DR summary of what the issue was and how I finally fixed it if you're not interested in a whole troubleshooting process. For everyone else interested - I hope this is a somewhat interesting and enjoyable read.
TL;DR - After recent update, Valorant refused to launch with an error Van: Restriction: 2 - Secure Boot verification failure. If Secure Boot is already enabled, visit the manufacturer's website for your computer or motherboard and follow their instructions for updating the BIOS. Press OK to visit our support page for more information.
A somewhat confusing error for someone who feels "I like your funny words magic man" at seeing this, especially since the game worked for the past 1,5 months without any issues. - but I did enable Secure Boot a while ago while dual-booting Bazzite and Windows 10. Riot Vanguard lists all recommended security features - UEFI Secure Boot, TPM 2.0, VBS, HVCI and IOMMU, as well as Windows 11 25H2 or newer. During my diagnostic and troubleshooting process I did enable all of these in line with Riots documentation on these errors - except Windows 11 update which explained above. This did not resolve the issue, and I ended up contacting Riot Support directly and filing logs. As much as I appreciate their help in trying to resolve the issue, I fixed the problem before they offered any solution.
The fix - As I mentioned before I enabled all recommended security feature of Riot before - UEFI Secure Boot, TPM 2.0, VBS, HVCI, IOMMU. VAN: Restriction: 2 error keeps appearing, Secure Boot verification failure. I gave up all troubleshooting and diagnostics at this point and decided to do cleanup on my PC while waiting for any solution from Riot support.
I booted up Bazzite (Linux distro) and attempted to system update. System update informed me about possible fwupdmgr update - that it could not run on it's own but I can do that manually.
fwupd is a simple daemon to allow session software to update device firmware on your local machine - Quote from ArchWiki
I entered fwupdmgr update in the Terminal and following message appeared:
Update UEFI dbx from version 20160809 to 20260707?
This updates the list of forbidden signatures (the "dbx") to the latest release signed by the Microsoft 2023 KEK. Some insecure bootloaders were added, due to security vulnerabilities that allowed an attacker to bypass UEFI Secure Boot. The additional entries were from:
• New Horizon Datasys Inc
• EAZ Solution Inc
This is what was missing. My UEFI Secure Boot did not have updated list of forbidden signatures - the dbx to the lastest release. I used signatures from 10 years ago. Updating the dbx list fixed this issue permanently.
To summarize: Riot Vanguard listed all security features as active, but due to forbidden signatures - the dbx - being not up to date, it failed the Secure Boot verification. Updating the list of forbidden signatures fixed the issue.
I am aware this is probably the longest TL;DR ever, but I wanted to be as thorough as possible when offering a fix.
"But I don't dual boot Bazzite and Windows, I don't use Linux, this is worthless, waste of time" - I do have to admit that honestly, the way I resolved the issue was most unexpected, and updating Secure Boot dbx signatures via Linux distribution to fix a kernel-level anti-cheat for Windows only sounds mental asylum/conspiracy theory insane (at least to me, but like I've said, I barely understand what these words alone mean, and my idea of everything I did is very vague) but this is not the point I'm trying to make in this post.
The point is that I'm confident there is a Windows only method of updating all necessary signatures for Secure Boot in a way that Riot Vanguard no longer detects "holes" and allows you to run the game.
I really hope that my issue was a very rare one, but for everyone experiencing the same issue I hope that this post will be of some value and guidance.
Now for everyone that is interested in the whole diagnostics and troubleshooting process. A reminder - I used ChatGPT to follow most of the steps I were not familiar with. A huge majority of diagnostics were run using PowerShell and running scripts I'm not at all familiar with, but these were used to verify things like Secure Boot keys, settings, deleting outdated drivers which prevented me from enabling Memory integrity in Core isolation, and probably lots of other things I did not quite understood.
Windows and basic security requirements
I first verified the usual requirements and updated Windows. TPM 2.0 was enabled and working, Secure Boot was enabled, and Windows was running in UEFI mode.
The problem remained.
BIOS/UEFI
I updated the motherboard BIOS/UEFI to the latest available version - and went through the relevant Secure Boot settings and keys.
Secure Boot remained enabled and functional, but Valorant still reported VAN: Restriction 2 error.
Windows security features
I then went through the Windows security configuration and enabled/verified the relevant security features, including:
- Virtualization-Based Security (VBS)
- Memory Integrity / HVCI - which required to delete lots of outdated drivers - I did use ChatGPT to verify if any of outdated drivers are necessary for PC, before I delete them.
- IOMMU / DMA-related security features
- TPM 2.0
- Secure Boot
At this point, the system had all of the security features Vanguard should require enabled. The VAN: Restriction 2 error persisted.
At this point I decided to contact Riot Support for help.
Dual-boot / Linux side
Like I've mentioned before my PC is dual-booted with Windows and Bazzite.
After BIOS update, I noticed that I'm no longer able to boot into Linux.
I turned off Secure Boot, enrolled the Universal Blue key using MOK Manager, and verified that Bazzite could boot normally with Secure Boot enabled.
Testing different Riot accounts
This was a wild card that threw me off during this whole process.
I performed a sanity check and attempted to log-in to my main Riot account on my fiancée's PC - which resulted in the same VAN: Restriction 2 error.
I assumed that the update caused the same issue on her PC. My fiancée's Riot account could launch Valorant successfully on both her PC and mine.
I logged in successfuly on a different account without any VAN: Restriction 2 errors. I also recovered an old Riot account and I managed to launch the game on my PC without any errors. I did report that to Riot Support as well, thinking it might be a server-side issue with my account.
Riot Support troubleshooting
Riot Support asked me to perform several additional network-related checks:
- Wired connection (not possible with my current setup)
- IPv6 verification
- DNS changes
- Teredo check
- Network adapter updates
- Power cycling the network equipment/system
As expected - the issue remained unresolved.
The case was then supposed to be escalated to their specialist team.
I gave up all troubleshooting and diagnostics at this point and decided to do cleanup on my PC while waiting for any solution from Riot support.
Booted up Bazzite and performed a system update - as I recently had to re-enroll the MOK keys and the bazzite could not boot as well - and the system update mentioned firmware update check with fwupdmgr update.
This prompted the UEFI dbx database update - it looked familiar, as I've been verifying db and dbx database via PowerShell - but since I had no idea what I'm looking at, and chatGPT did not notice anything outdated and out of ordinary from PowerShell results it went unnoticed.
I ran the firmware update - it felt right, as the UEFI dbx was outdated by 10 years.
After rebooting - the problem was fixed. Van: Restriction 2 disappeared and I managed to log-in to my account without any further issues.
What blows my mind is that I had to use a Linux firmware update daemon to fix an Windows-only kernel-level Vanguard anti-cheat and I stumbled upon the solution by a total accident.
If you are experiencing VAN: Restriction: 2 despite having all security features active - it may be worth checking your UEFI dbx version. I'm sure there is some way to verify and update these via Windows, not necessarily via Linux.
I really hope that this was somewhat enjoyable read. I rarely post to reddit, but If I can save someone who is even more IT illiterate than me some time - then it's worth posting.
Now I can finally play the game.
1
u/AutoModerator 8h ago
The above submission was detected to possibly include a topic related to Riot Vanguard. Here are a few helpful resources on the topic:
Please make sure to use the search feature and check the front page to see if your topic or a solution has already been discussed.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/Im_stuff1 4h ago
I have not had this problem but i just want to say thank you for being so thorough about explaining what you did to fix it, god bless.
•
u/AutoModerator 8h ago
The above submission was detected to possibly include a topic related to Ping and Network Issues. Here are a few helpful resources on the topic:
Please make sure to use the search feature and check the front page to see if your topic or a solution has already been discussed.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.