IOMMU and VBS in FACEIT: What Changed in Anti-Cheat Requirements by August 2026

Chronology: What Was and What Is Now

The key difference is straightforward: IOMMU and VBS were initially enforced only for selected accounts, so some players could still join matches with virtualisation disabled. They are now part of FACEIT’s expanding baseline security requirements, although enforcement may still depend on the account and hardware compatibility.

What IOMMU Is and Why It Broke DMA Cheats

IOMMU stands for Input-Output Memory Management Unit. Intel calls this technology VT-d, AMD calls it AMD-Vi. The simplest way to think of it is as an access controller between PCIe devices and system memory.

DMA-capable devices can transfer data to and from system memory without the CPU copying every block itself. This is essential to the performance of graphics cards, network adapters, and storage controllers, but the same capability can be abused by cheats. A dedicated PCIe device may attempt to read game data from the gaming PC and send it to a second computer. Because no conventional cheat process needs to run on the gaming PC, this approach is harder for traditional software-only checks to detect.

IOMMU introduces address translation and access control for DMA-capable devices, limiting each device to authorised regions of memory. Windows uses these capabilities for Kernel DMA Protection and DMA remapping. According to Microsoft, the protection depends on compatible UEFI firmware, enabled I/O virtualisation, and supported device drivers; its status is shown in System Information.

The effect on DMA cheats was significant. According to an external audit commissioned by FACEIT from Intorqa, standard DMA cheats stopped working shortly after enforcement expanded, and discussions in private forums changed rapidly. FACEIT also reported banning more than 200 players for DMA-based cheating during three months of limited rollout, including around 20 players using devices priced at approximately $4,500.

Why VBS Was Added on Top of IOMMU

VBS stands for Virtualisation-Based Security. It is a built-in Windows security architecture that uses the Windows hypervisor to create an isolated environment for sensitive security functions. This protected environment remains separated from the normal Windows kernel, even if kernel-level code is compromised.

FACEIT requires VBS because it helps the anti-cheat enforce IOMMU protections reliably in Windows. A security decision based only on a value reported by the normal operating-system environment would be easier to tamper with; placing the relevant protections behind the hypervisor makes manipulation substantially more difficult.

Memory Integrity, also known as HVCI (Hypervisor-Protected Code Integrity), is a security feature built on VBS. It validates kernel-mode code before allowing it to run and prevents executable kernel-memory pages from also being writable. This helps block attacks that load vulnerable signed drivers to gain kernel access. FACEIT may require Memory Integrity for specific players and lists it separately in its support documentation.

The full VBS requirement list from Microsoft documentation looks like this:

The IOMMU entry is important: Microsoft includes DMA protection among the hardware capabilities used to strengthen VBS and Memory Integrity. FACEIT’s combination of IOMMU and VBS follows the same security model.

TPM 2.0 and Secure Boot: What They Do on Their Own

These two mechanisms cover boot, not memory.

Secure Boot builds a chain of trust: firmware checks the signature of every component that starts before the OS and blocks unsigned code. That closes UEFI-level cheat loaders.

TPM adds Measured Boot. The module hashes each boot stage and stores the results in protected registers. It can then issue a cryptographically signed report of how the system actually booted. The procedure is called attestation, and FACEIT anti-cheat checks that report’s signature before connecting to a match. You cannot fake it without access to the keys inside the chip.

The division of labor is this: Secure Boot and TPM cover a clean system start, IOMMU and VBS cover what happens after start. None of the four mechanisms replaces the others.

How to Check Your PC in Five Minutes

Before you open BIOS, see what is already enabled.

To open System Information, press the Windows key, type msinfo32, and press Enter. The Processor and BaseBoard Manufacturer lines there also show the CPU and motherboard model, which you will need to find the right BIOS item.

How to Enable IOMMU in BIOS

Menu names differ by manufacturer, so identify the board model first. Below are the routes for the three vendors FACEIT itself describes.

If your vendor is not on the list or the items are missing, there are two steps. First: update BIOS, because on older firmware the menu with these parameters may simply not exist. Second: search for “how to enable IOMMU” plus the exact board model, or read the manufacturer’s manual.

A completely missing VT-d or AMD-Vi item means the CPU or board does not support them. Support exists on almost all processors from about 2015 onward.

How to Enable Virtualization, VBS, and Memory Integrity

VBS is not enabled in BIOS directly. Firmware needs hardware virtualization: Intel VT-x or AMD SVM Mode. Without it, Windows will not even show the Core isolation section.

Then in Windows:

1. Press the Windows key, type Windows Security, and open the app.
2. On the left, choose Device security.
3. In the Core isolation block, click Core isolation details.
4. Set Memory integrity to On. Administrator rights are required.
5. Restart the computer.

On clean Windows 11 installations, Memory Integrity may be enabled by default when the device meets Microsoft’s hardware and driver compatibility requirements. These include a supported 64-bit processor, hardware virtualisation, sufficient memory and storage, and compatible drivers. Systems upgraded from an earlier Windows version may retain their previous setting, so check Memory Integrity manually after an upgrade.

If the Memory integrity toggle is unavailable, an incompatible driver may be blocking the feature. Select Review incompatible drivers to identify the affected components. Update those drivers from the hardware manufacturer, or uninstall the associated device software if it is no longer needed.

What to Do If the PC Will Not Boot After the Changes

This is the most unpleasant scenario, and FACEIT put it in a separate guide. The order of actions is as follows.

General rule: change one parameter at a time and check boot after each step. That way you immediately see which item conflicts with your configuration.

Do IOMMU and VBS Reduce FPS?

FACEIT is cautious: TPM and Secure Boot do not affect performance; IOMMU and VBS can cause a small drop in some cases, more often on older systems and boards with unfinished firmware.

One independent 15-game benchmark on then-current hardware measured an average performance reduction of about 5% with VBS enabled at 1080p. Microsoft Flight Simulator showed the largest reduction in that test: 11% at 1080p and 8% at 4K. At 4K, the average difference was generally below 3% because performance was more often limited by the GPU. Results vary by processor, game, Windows version, and enabled VBS features.

The final row is important. Memory Integrity performs best on processors with Intel MBEC or AMD GMET support. On older CPUs, Windows may emulate the required behaviour in software, increasing the performance overhead. Modern platforms therefore tend to be affected less, although the exact difference in CS2 depends on the complete system configuration.

Practical takeaway for CS2: on a current platform, enabling IOMMU and VBS will not knock you out of a comfortable frame range, while on a ten-year-old CPU the difference will show in both benchmarks and feel. If the system is already at its limit, a platform upgrade solves it more reliably than hunting for a way around the requirements.

Who Will Have to Change Hardware

Most systems fall into one of three categories.

Another important date is 14 October 2026, when FACEIT plans to stop supporting Windows 10. Microsoft ended standard Windows 10 support on 14 October 2025, and the consumer ESU programme runs until 13 October 2026. FACEIT aligned its schedule with the end of those extended security updates.

If your CPU and board do not meet Windows 11 requirements, you have one scenario: a platform upgrade. You can pick a ready-made CS2 PC with a modern CPU, VT-d or AMD-Vi support, and correct firmware in the HYPERPC gaming PC catalog.

Does This Even Work Against Cheaters

FACEIT also cites external monitoring data rather than relying solely on its own claims.

The external audit FACEIT commissioned from Intorqa tracked the CS2 cheat market from late 2025 through March 2026. What was recorded:

• The number of tracked cheat sellers for the platform grew from 50 to 88, while purely software cheats almost disappeared from the market.
• After the IOMMU requirement expanded, standard DMA cheats stopped working, and discussion on closed forums changed tone within days.
• The first bypass attempt via Intel VMD spiked interest in December 2025, then faded quickly: buyer reviews shifted from “it works” to “unstable and risky” amid ban waves.
• From January to March 2026, more than 25 sellers advertised SSD- and NVMe-emulation products as IOMMU bypasses. According to the audit, these products did not provide a confirmed working bypass.
• No confirmed IOMMU bypass was found by the end of the audit, even though some sellers asked up to $1,500 a month for such promises.
• The audit estimated IOMMU coverage at about 97%. This was an external estimate rather than a universal-enforcement figure published by FACEIT.

There is also a trade-off: pressure on DMA cheats can shift demand towards two-PC and computer-vision methods that use video capture and external input emulation rather than reading game memory. Hardware memory protections do not directly address this category, so anti-cheat systems must also rely on behavioural detection, including aim patterns, reaction times, and movement analysis.

In other words, IOMMU and VBS make a common class of DMA-based cheats substantially harder to use, but they do not eliminate every form of cheating.

Conclusion

FACEIT is extending anti-cheat checks beyond software alone: Secure Boot and TPM help verify the boot chain, while IOMMU and VBS strengthen memory protection and enforcement. Together, these measures make DMA-based cheating considerably more difficult and expensive.

For many players, meeting the requirements involves enabling a few BIOS/UEFI settings and updating the firmware. Older or incompatible systems may require additional troubleshooting or a hardware upgrade. Those systems must also account for FACEIT’s planned transition to Windows 11 on 14 October 2026.

Check System Information now. If Kernel DMA Protection is Off, review your motherboard documentation and address the configuration well before your next match.