Solved VAN 1067 without reinstalling Windows. Cause: a per-process exploit mitigation on vgc.exe nobody touches during uninstall.
5 months ago, I had a problem with Lol after a vanguard update. Every single time I'd do a user input (key/mouse press) it would freeze for 3 seconds, then after I re-installed it and ran the repair I got a "VAN 1067" error. After re-installing Windows it worked.
The other day, I re-installed LOL and got another VAN 1067. I'm using a modified Windows OS (Revo) to kill a lot of the bloat that windows carries, but this still didn't make sense it's caused the issue because the game was working on the fresh Revo Install.
I used Cursor to help me get to the bottom of it and this is what what it said and the issue is. I've also provided a link to a .ps1 you can run to fix it yourself - https://pastebin.com/dpSEFx6F
---
It turns out the real cause is a per-process **exploit-protection override** on
vgc.exe (Vanguard's user-mode service) that lives in this registry key:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgc.exe
Inside it, a 24-byte binary value called `MitigationOptions` was set to:
00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
That single `0x01` byte force-enables one mitigation policy
(`PROCESS_CREATION_MITIGATION_POLICY_*`) on vgc.exe and **only** vgc.exe.
Recent Vanguard builds use a startup code path that violates that mitigation,
so the kernel kills the process immediately on launch. Service Control Manager
sees vgc.exe die and reports `WIN32_EXIT_CODE: 1067` ("the process terminated
unexpectedly") — which is literally where the Riot Client gets "VAN 1067" from.
Tell-tale signs in Event Viewer:
* `System` log: repeated "The vgc service terminated with the following error:
Incorrect function" / "The vgc service terminated unexpectedly".
* `Application` log: `Application Error` with
`Faulting application name: bad_module_info`, `Faulting module name: unknown`,
`Exception code: 0x00000000`. That signature is what a kernel-initiated
mitigation kill looks like (a normal crash has a real module + a non-zero
exception code).
**Why every standard fix fails:**
The IFEO key lives under `HKLM\SOFTWARE\Microsoft\...` — completely outside
`C:\Program Files\Riot Vanguard\`, outside the `vgc`/`vgk` services, and
outside everything any Riot installer or "repair" tool ever touches.
You can:
* Uninstall + reinstall League
* Uninstall + reinstall the Riot Client
* Uninstall + reinstall Vanguard via Programs & Features
* Run the Riot repair tool
* Delete `C:\Program Files\Riot Vanguard` manually
* `sc delete vgc` and `sc delete vgk`
…and the IFEO key sits there the whole time, silently killing vgc.exe on the
next launch. The only thing that wipes it is a **full Windows reinstall**,
because that re-creates the registry from scratch. That's why a fresh Windows
install always "fixes" it.
**Where it comes from:**
Probably one of these, depending on your system history:
* An older Vanguard installer wrote it years ago as defense-in-depth, then
changed its own code in a later update and forgot the override existed.
* A debloated/hardened Windows variant (ReviOS, AtlasOS, etc.) applied an
Exploit Protection profile that included vgc.exe.
* A third-party hardening tool (HardenTools, ConfigureDefender,
Hard_Configurator, Process Hacker scripts, etc.) wrote it.
It doesn't matter which — the fix is the same: delete the key.
**Manual fix (3 minutes, no tools needed):**
Press `Win+R`, type `regedit`, hit Enter (accept the UAC prompt).
Navigate to:
`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgc.exe`
If that subkey exists, right-click it → Export (save the `.reg` to your
Desktop as a backup so you can restore it if you ever want to).
Right-click the `vgc.exe` subkey again → Delete → Yes.
**Reboot.**
Launch the Riot Client. If Vanguard prompts to reinstall, let it (and
accept its own reboot when prompted).
League should now launch. VAN 1067 gone.
If the `vgc.exe` subkey under `Image File Execution Options` doesn't exist
on your machine, your VAN 1067 has a different cause and this won't help you —
sorry. Common other causes are missing TPM/Secure Boot on Win11, conflicting
anti-cheat drivers, or actually-corrupted Vanguard installs.
**Automated fix (script):**
Below is a self-contained PowerShell script. It self-elevates, exports the
key as a `.reg` backup to your Desktop, then deletes it. It will NOT do
anything if the key doesn't exist on your system — safe to run either way.
**Save it as `fix-van1067.ps1`**, right-click → "Run with PowerShell".
Accept the UAC prompt. Reboot when it tells you to.