FACEIT Anti-Cheat Not Working: Every Error Fixed
Every common FACEIT AC error — Secure Boot, TPM 2.0, IOMMU, VBS, service won't start — with the real cause and the right order to avoid BitLocker.
Almost every FACEIT Anti-Cheat failure comes down to the same thing: over the past two years FACEIT has made four Windows security mechanisms mandatory, and if even one of them is off, the match simply will not start. The game itself runs fine, which is where the confusion comes from — "CS2 works, but FACEIT won't let me in."
Below is a table of errors with their causes, then the order of operations. The order matters: enabling things at random can leave you without a booting Windows, or staring at a BitLocker recovery prompt.
Table: what each error actually means
| What FACEIT says | The real cause | Where to go |
|---|---|---|
| Secure Boot is not enabled | Secure Boot is off in UEFI, or CSM is on | enable Secure Boot |
| TPM 2.0 needs to be enabled | The trusted platform module is off, or running as 1.2 | enable TPM 2.0 |
| The service cannot be started | The FACEITService is disabled in Windows | fix the service |
| IOMMU / VBS is not enabled | Virtualization or core isolation is off | enable IOMMU and VBS |
| Important Windows security updates are missing | Cumulative security updates are not installed | Windows Update, until it says you are current |
| Secure Boot is on, but FACEIT doesn't see it | The disk uses MBR, so the system boots in Legacy mode | convert the disk to GPT |
Check your system in two minutes
Before you go into UEFI, look at what is already on. Two windows give you the whole picture.
First. Press Win + R, type msinfo32, and read four lines in System Information:
| Line | What it should say |
|---|---|
| BIOS Mode | UEFI (if Legacy — start with GPT) |
| Secure Boot State | On |
| Virtualization-based security | Running |
| Device Encryption Support | no error messages |
Second. Win + R, then tpm.msc. You want "The TPM is ready for use" and specification version 2.0. If the window says "Compatible TPM cannot be found", the TPM is disabled in UEFI rather than physically absent: nearly every CPU since 2016 has one built in.
The right order
Each step depends on the previous one, so work top to bottom and confirm Windows still boots after each.
- Disk layout — GPT. Secure Boot physically does not work on an MBR disk. If
msinfo32shows "BIOS Mode: Legacy", start here. - Boot mode — UEFI, CSM off. CSM (also called Legacy Support or Compatibility Support Module) and Secure Boot are mutually exclusive.
- Secure Boot — enabled. On some boards the option only appears after you set the OS type to "Windows UEFI".
- TPM 2.0 — enabled. Intel calls it PTT, AMD calls it fTPM. You do not need to buy a separate chip.
- Virtualization and IOMMU. VT-x/SVM plus VT-d (Intel) or IOMMU (AMD).
- Core isolation — memory integrity. Last, because it is switched on from inside Windows and requires everything above.
First, about BitLocker
This is the one place where a mistake is expensive, and almost nobody warns you about it.
If your disk is encrypted with BitLocker, changing TPM or Secure Boot settings breaks the key binding, and the next boot will demand a 48-digit recovery key. Without it the data is gone — completely.
What to do before going into UEFI:
- Open "Manage BitLocker" from the Start menu search.
- If encryption is on, click "Suspend protection", or save the recovery key to your Microsoft account or a USB stick in advance.
- You can confirm the key exists on your Microsoft account page under "Devices".
On most prebuilt laptops BitLocker is on out of the box and the owner has no idea — so check even if you are sure you never encrypted anything.
Everything is on and FACEIT still complains
Then it is one of three things:
- Security updates are missing. FACEIT requires a current Windows kernel. Run Windows Update until it reports you are up to date, reboot, and try again.
- A blacklisted driver is in the way. Memory integrity will not turn on while a vulnerable driver is installed — Windows names the file right in the error. Usually it is an old RGB, overclocking, or monitoring utility.
- A second anti-cheat is installed. Vanguard, ESEA, and similar run at kernel level and conflict. Keep one.
If FACEIT AC still refuses to start after all of that, reinstall the client: remove the anti-cheat from Installed apps, reboot, and install it again from the FACEIT site — that cures a broken service installation.
What FACEIT requires next
From October 14, 2026, Windows 11 becomes the only supported system: matches will stop launching on Windows 10 regardless of whether Secure Boot and TPM are enabled. Details and options are in the separate piece on FACEIT and the move to Windows 11.
Why the order matters
The anti-cheat requirements look like a list of checkboxes, but there are dependencies between them, and a broken order turns a half-hour task into an evening with recovery keys.
The correct sequence goes bottom-up, from the disk layout to Windows settings. First the disk must be GPT — without that Secure Boot cannot be enabled at all. Then, in UEFI, CSM goes off and Secure Boot and TPM go on. Only after that does it make sense to touch core isolation inside Windows.
The reverse order punishes immediately. Enable Secure Boot on an MBR disk and you get a system that will not boot. Change the TPM configuration with BitLocker on and you get a recovery key prompt on a black screen. Both are recoverable, but they cost nerves precisely because the steps were swapped.
Hence the rule: before your first trip into UEFI, check two things — the disk partition style and the BitLocker state. Both checks take a minute and remove most of the unpleasant scenarios.
Where do I start if several errors appear at once? With the disk layout and BitLocker. Those two decide whether it is safe to touch UEFI at all, and nearly every painful scenario grows from not checking them first.