War Thunder is unusual: it runs two anti-cheats at once — BattlEye in the kernel and Viking in user space. That pairing is a useful window into how anti-cheat actually works, because the two sit at very different privilege levels and do very different jobs. One can build a hardware fingerprint of your PC; the other deliberately can't.
If you play War Thunder, or you just want to understand the difference between a kernel anti-cheat and a ring-3 one, this breakdown covers what each system does, how the hardware bans work, and what Gaijin says about your data.
Quick reference: War Thunder's two anti-cheats
| BattlEye | Viking | |
|---|---|---|
| Privilege level | Kernel (Ring 0) | User space (Ring 3) |
| Loads | A driver alongside the game | Embedded in the game client |
| Admin rights | Yes | No |
| Reads hardware IDs | Yes — builds a fingerprint | No |
| Issues HWID bans | Yes | No |
Viking: a ring-3 anti-cheat by design
Viking is built into the game client and runs at ring 3 — ordinary user privileges. Gaijin is explicit that it does not have the access required for administrator-level data, because the game itself doesn't request those permissions. It isn't isolated the way a kernel driver is; instead it's tuned for high responsiveness inside the game's own process, focused on catching cheats interacting with the game directly. The trade-off is straightforward: less system visibility, but a far smaller footprint and fewer privacy questions.
BattlEye: the kernel half that fingerprints your PC
BattlEye is the heavier component. It loads a driver that runs alongside the game, monitors system activity, scans for cheat signatures, and collects hardware identifiers that form a persistent hardware fingerprint of your machine. That kernel position is what makes a hardware ban possible — and War Thunder leans on it. For the full picture of this engine across the many games that use it, see our BattlEye explainer.
How War Thunder's hardware bans work
By default, hardware bans are permanent, with no appeal and no expiration. Crucially, the system uses composite matching: it requires multiple identifiers to change simultaneously before it treats a machine as genuinely new. That's the same logic we break down in why partial hardware changes don't beat a ban — swapping one part leaves the rest of the fingerprint intact, so the ban holds.
A note of honesty here: tools that change Windows-level identifiers operate in user mode and don't rewrite firmware-resident values like the SMBIOS UUID or motherboard serial. Because BattlEye's ban is a firmware-anchored composite, no honest tool promises a guaranteed unban.
What about your data?
Gaijin's development blog leans on GDPR compliance and stresses that enforcement isn't purely automated — player reports, statistics, and server logs are reviewed by a dedicated team, and only players confirmed as cheaters through manual review face action. If you're weighing the privacy side of kernel anti-cheat in general, our piece on kernel anti-cheat and privacy covers the broader debate.
FAQ
Does War Thunder use kernel-level anti-cheat?
Yes, partly. BattlEye runs in the kernel; Viking runs at ring 3 in user space. They operate together.
Can War Thunder HWID ban me?
Yes, through BattlEye. Hardware bans are permanent by default, with no appeal, and follow your machine rather than your account.
Does Viking read my hardware?
No. Viking runs without administrator rights and is not designed to collect the firmware-level identifiers a hardware ban relies on.
Will changing one component lift a War Thunder ban?
Unlikely. The composite matching requires several identifiers to change at once before the machine is treated as new.
The takeaway
War Thunder's two-anti-cheat setup is a clean illustration of the privilege spectrum: a ring-3 component that stays out of your system internals, and a kernel component that can fingerprint your hardware and issue permanent, composite-matched bans. Understanding which layer does what tells you exactly why a hardware ban is hard to escape — and why no user-mode tool can honestly promise to undo one.