Riot's Vanguard is the most aggressive mainstream anti-cheat, and it is worth understanding why.
It runs before the game does
Unlike most anti-cheats, Vanguard's component loads at system startup and stays active even when you are not playing. That gives Riot the ability to read hardware signals at any time, not just during a match — and it is why a Vanguard ban is so durable.
What it reads
Vanguard builds a thorough hardware picture — motherboard and SMBIOS data, network and disk identifiers, the TPM, the GPU — and it also checks the boot environment, Secure Boot state and the presence of suspicious drivers or virtual machines. Inconsistencies stand out to it immediately.
Why it is hard to get past
Vanguard's ban policy is strict and largely automated. More importantly, it reads identifiers that live in firmware and the boot chain — exactly the layers ordinary software cannot change. This is the honest part: a software HWID change addresses the Windows, disk and network identifiers, but against a Vanguard-class anti-cheat that specifically reads firmware-level values, a software change has a real limit. Where Vanguard is concerned, different physical hardware is often the only sure route.
The bigger picture
Vanguard is a preview of where mainstream anti-cheat is heading. The practical takeaway is not a trick — it is to understand that hardware identity is becoming firmware-rooted, and to be realistic about what software can and cannot do about it.