IOMMU and VBS in FACEIT: What Changed in Anti-Cheat Requirements by August 2026

Quick algorithm: how to clear the anti-cheat error

If anti-cheat already blocks you from a match, follow this order. The steps run in this sequence: each one depends on the previous.

1. Read the error text. Anti-cheat always names the specific mechanism: TPM 2.0, Secure Boot, IOMMU, virtualisation, or Memory Integrity. Fix only that one, not everything at once.
2. Check the current state. Press Windows, type msinfo32, and look at BIOS Mode, Secure Boot State, Kernel DMA Protection, and Virtualization-based security. Check TPM in tpm.msc and Memory Integrity in Windows Security.
3. If BIOS Mode shows Legacy, first convert the system disk from MBR to GPT with Microsoft’s mbr2gpt utility and switch the firmware to UEFI. Without that, Secure Boot will not turn on, and enabling it blindly will cause a boot failure.
4. Update BIOS to the current version. That closes two problem classes at once: missing menu items and TPM attestation errors on AMD boards.
5. Enable the required BIOS items in one session: TPM (Intel PTT or AMD fTPM), Secure Boot, IOMMU (VT-d on Intel, IOMMU or AMD-Vi on AMD), and hardware virtualisation (VT-x or SVM Mode). Change one parameter at a time and check boot after each.
6. Enable Memory Integrity in Windows if the error asks for it specifically: Windows Security, Device security, Core isolation details, set the toggle to On, then restart.
7. If the toggle is unavailable, open Review incompatible drivers, update or remove the listed drivers (most often old peripherals and RGB lighting software), and repeat step 6.
8. If the system stopped booting, revert the last BIOS change, then check two conflicts: Above 4G Decoding with integrated plus discrete graphics, and a RAID array together with IOMMU.
9. Restart the PC and launch anti-cheat again. The check runs when the client starts; you do not need to confirm anything separately. If the required mechanism is on, the error window will not appear.
10. If the BIOS item is still missing after a firmware update, this hardware has no support. There is no workaround; the only fix is moving to a supported platform.

Details for each step, including the exact BIOS routes for ASRock, ASUS, and MSI, are covered below.

Chronology: What Was and What Is Now

The key difference from the previous picture is simple. IOMMU and VBS used to be selective, and a player with virtualisation disabled could join matches for years. They are now effectively a baseline entry requirement: only accounts the latest wave has not yet reached remain uncovered. FACEIT still formally calls the rollout staged and has not published a full-coverage date, so treat the settings as mandatory today.

What IOMMU Is and Why It Broke DMA Cheats

IOMMU stands for Input-Output Memory Management Unit. Intel calls this technology VT-d, AMD calls it AMD-Vi. The simplest way to think of it is as an access controller between PCIe devices and system memory.

DMA-capable devices can transfer data to and from system memory without the CPU copying every block itself. This is essential to the performance of graphics cards, network adapters, and storage controllers, but the same capability can be abused by cheats. A dedicated PCIe device may attempt to read game data from the gaming PC and send it to a second computer. Because no conventional cheat process needs to run on the gaming PC, this approach is harder for traditional software-only checks to detect.

IOMMU puts devices into address-translation mode: each one gets its own memory window and physically cannot reach beyond it. Windows uses this mechanism in Kernel DMA Protection: devices whose drivers support DMA remapping start normally, while others are blocked by default if they were connected before the user signed in or while the screen is locked. According to Microsoft, Kernel DMA Protection requires UEFI firmware and I/O virtualisation enabled in firmware, and the feature status is shown in System Information.

The effect on DMA cheats was significant. According to an external audit commissioned by FACEIT from Intorqa, standard DMA cheats stopped working shortly after enforcement expanded, and discussions in private forums changed rapidly. FACEIT also reported banning more than 200 players for DMA-based cheating during three months of limited rollout, including around 20 players using devices priced at approximately $4,500.

Why VBS Was Added on Top of IOMMU

VBS stands for Virtualisation-Based Security. It is a built-in Windows security architecture that uses the Windows hypervisor to create an isolated environment for sensitive security functions. This protected environment remains separated from the normal Windows kernel, even if kernel-level code is compromised.

FACEIT requires VBS because it helps the anti-cheat enforce IOMMU protections reliably in Windows. A security decision based only on a value reported by the normal operating-system environment would be easier to tamper with; placing the relevant protections behind the hypervisor makes manipulation substantially more difficult.

Memory Integrity, also known as HVCI (Hypervisor-Protected Code Integrity), is a security feature built on VBS. It validates kernel-mode code before allowing it to run and prevents executable kernel-memory pages from also being writable. This helps block attacks that load vulnerable signed drivers to gain kernel access. FACEIT may require Memory Integrity for specific players and lists it separately in its support documentation.

The full VBS requirement list from Microsoft documentation looks like this:

Note the IOMMU row. In Microsoft’s model, IOMMU is not an option for VBS but a constituent part of it. FACEIT’s requirements map onto this architecture one to one.

TPM 2.0 and Secure Boot: What They Do on Their Own

These two mechanisms cover boot, not memory.

Secure Boot builds a chain of trust: firmware checks the signature of every component that starts before the OS and blocks unsigned code. That closes UEFI-level cheat loaders.

TPM adds Measured Boot. The module hashes each boot stage and stores the results in protected registers. It can then issue a cryptographically signed report of how the system actually booted. The procedure is called attestation, and FACEIT anti-cheat checks that report’s signature before connecting to a match. You cannot fake it without access to the keys inside the chip.

The division of labor is this: Secure Boot and TPM cover a clean system start, IOMMU and VBS cover what happens after start. None of the four mechanisms replaces the others.

How to Check Your PC in Five Minutes

Before you open BIOS, see what is already enabled.

To open System Information, press the Windows key, type msinfo32, and press Enter. The Processor and BaseBoard Manufacturer lines there also show the CPU and motherboard model, which you will need to find the right BIOS item.

How to Enable IOMMU in BIOS

Menu names differ by manufacturer, so identify the board model first. Below are the routes for the three vendors FACEIT itself describes.

If your vendor is not on the list or the items are missing, there are two steps. First: update BIOS, because on older firmware the menu with these parameters may simply not exist. Second: search for “how to enable IOMMU” plus the exact board model, or read the manufacturer’s manual.

A completely missing VT-d or AMD-Vi item means the CPU or board does not support them. Support exists on almost all processors from about 2015 onward.

How to Enable Virtualization, VBS, and Memory Integrity

VBS is not enabled in BIOS directly. Firmware needs hardware virtualization: Intel VT-x or AMD SVM Mode. Without it, Windows will not even show the Core isolation section.

Then in Windows:

1. Press the Windows key, type Windows Security, and open the app.
2. On the left, choose Device security.
3. In the Core isolation block, click Core isolation details.
4. Set Memory integrity to On. Administrator rights are required.
5. Restart the computer.

On a clean Windows 11 install, Memory Integrity turns on automatically if the conditions match: an 8th-generation Intel processor or newer (for version 21H2 the bar is higher, from 11th generation), or AMD Zen 2 and newer, at least 8 GB of RAM, a system SSD of 64 GB or more, virtualisation enabled in BIOS, and compatible drivers. Automatic enablement does not run on an upgrade from a previous version, so a move from Windows 10 almost always needs a manual visit to the settings.

If the Memory integrity toggle is unavailable, an incompatible driver may be blocking the feature. Select Review incompatible drivers to identify the affected components. Update those drivers from the hardware manufacturer, or uninstall the associated device software if it is no longer needed.

What to Do If the PC Will Not Boot After the Changes

This is the most unpleasant scenario, and FACEIT put it in a separate guide. The order of actions is as follows.

General rule: change one parameter at a time and check boot after each step. That way you immediately see which item conflicts with your configuration.

Do IOMMU and VBS Reduce FPS?

FACEIT is cautious: TPM and Secure Boot do not affect performance; IOMMU and VBS can cause a small drop in some cases, more often on older systems and boards with unfinished firmware.

Independent measurements give a more specific picture. In a public 15-game test on a then-current CPU paired with a GeForce RTX 4090, enabling VBS cost about 5 percent of frames at 1080p on average. Microsoft Flight Simulator dropped the most: minus 11 percent at 1080p and minus 8 percent at 4K. At 4K the difference usually falls below 3 percent because the load shifts to the GPU.

The last row needs a note. Memory Integrity relies on a hardware acceleration mechanism: MBEC on Intel and GMET on AMD. Microsoft lists it among the conditions without which VBS and Memory Integrity do not turn on automatically. On platforms where hardware support is missing or weaker, hypervisor overhead is noticeably higher, and older systems suffer from VBS the most.

Separately, a boundary on these figures: there are no fresh CS2 measurements on current hardware in the public domain, so read the numbers above as an order of magnitude, not a forecast for a specific configuration.

Practical takeaway for CS2: on a current platform, enabling IOMMU and VBS will not knock you out of a comfortable frame range, while on a ten-year-old CPU the difference will show in both benchmarks and feel. If the system is already at its limit, a platform upgrade solves it more reliably than hunting for a way around the requirements.

Who Will Have to Change Hardware

Most systems fall into one of three categories.

Another important date is 14 October 2026, when FACEIT plans to stop supporting Windows 10. Microsoft ended standard Windows 10 support on 14 October 2025, and the consumer ESU programme runs until 13 October 2026. FACEIT aligned its schedule with the end of those extended security updates.

If your CPU and board do not meet Windows 11 requirements, you have one scenario: a platform upgrade. You can pick a ready-made CS2 PC with a modern CPU, VT-d or AMD-Vi support, and correct firmware in the HYPERPC gaming PC catalog.

Does This Even Work Against Cheaters

FACEIT also cites external monitoring data rather than relying solely on its own claims.

The external audit FACEIT commissioned from Intorqa tracked the CS2 cheat market from late 2025 through March 2026. What was recorded:

• The number of tracked cheat sellers for the platform grew from 50 to 88, while purely software cheats almost disappeared from the market.
• After the IOMMU requirement expanded, standard DMA cheats stopped working, and discussion on closed forums changed tone within days.
• The first bypass attempt via Intel VMD spiked interest in December 2025, then faded quickly: buyer reviews shifted from “it works” to “unstable and risky” amid ban waves.
• From January to March 2026, more than 25 sellers advertised SSD- and NVMe-emulation products as IOMMU bypasses. According to the audit, these products did not provide a confirmed working bypass.
• No confirmed IOMMU bypass was found by the end of the audit, even though some sellers asked up to $1,500 a month for such promises.
• The audit estimated IOMMU coverage at about 97%. This was an external estimate rather than a universal-enforcement figure published by FACEIT.

There is also a trade-off: pressure on DMA cheats can shift demand towards two-PC and computer-vision methods that use video capture and external input emulation rather than reading game memory. Hardware memory protections do not directly address this category, so anti-cheat systems must also rely on behavioural detection, including aim patterns, reaction times, and movement analysis.

In other words, IOMMU and VBS make a common class of DMA-based cheats substantially harder to use, but they do not eliminate every form of cheating.

Conclusion

FACEIT’s logic is unambiguous. The platform stopped fighting cheats at the software layer alone and moved the check onto hardware: trusted boot through Secure Boot and TPM, memory isolation through IOMMU, and a guarantee of that isolation through VBS. The DMA-cheat class that for years looked unbeatable stopped paying off after that.

For an honest player the cost is small: one visit to BIOS, virtualisation enabled, and current firmware. Problems start only where the hardware is older than ten years or the firmware has not been updated in a long time. Those configurations will hit the next line: 14 October 2026, when Windows 11 becomes mandatory.

Check msinfo32 right now. If Kernel DMA Protection shows Off, sort it out in a calm session rather than five minutes before a match starts.