Basics · 7 min read · Aug 8, 2026

HWID Ban Explained: What It Really Is and How to Get Around It

"HWID ban" gets thrown around like everyone knows what it means. Most players don't — and the ones who think they do usually stop at "they banned my computer, so I reinstall Windows and I'm fine." That has not been true since 2022. Here is what an HWID ban actually is, why the standard advice fails, and what a proper unban path looks like today.

What "HWID" means to an anti-cheat

HWID is short for hardware ID — a fingerprint of your machine built from identifiers baked into the physical components. It is not one number. It is a set of about a dozen values, hashed together, that the anti-cheat treats as a machine's identity.

When an anti-cheat like Vanguard, EAC, BattlEye, or Ricochet detects a cheat, it does two things. First it bans the account you were signed into. Second, if the detection was serious enough, it takes the current fingerprint of your machine and pushes it to a server-side blocklist. From then on, any account signed in from a machine whose fingerprint matches gets banned within seconds — sometimes on account creation.

What actually goes into the fingerprint

The exact list varies by anti-cheat. There is a common core they all read.

• Motherboard serial (from the SMBIOS tables in your BIOS/UEFI ROM)
• Chassis serial (same place)
• System UUID (same place — assigned at manufacture)
• Disk serial number (per drive, from the drive's firmware)
• Disk volume ID (a Windows-generated number that survives simple formatting)
• MAC address per network interface, read from the NIC's onboard ROM — not the Windows-facing value
• TPM manufacturer + endorsement key (Windows 11 25H2 makes this a hard requirement for Valorant and CoD Warzone)
• MachineGuid in the Windows registry, plus around ten other HWID-vector keys
• SMBIOS OEM strings the vendor stamps on the board
• CPU family + microcode revision (weak signal, but Vanguard reads it)

Why reinstalling Windows doesn't work

Reinstalling Windows changes exactly three of the identifiers above: MachineGuid, some volume IDs, and a couple of registry keys. It changes nothing that lives in firmware. Your motherboard serial, chassis serial, system UUID, every disk serial, every NIC's factory MAC, and your TPM's endorsement key are all identical after the reinstall.

Anti-cheats now use partial matching. If four or five of the dozen identifiers still match a banned fingerprint, that's enough to instant-ban a new account on sight. So the "reinstall and I'm fine" path fails almost immediately.

What "permanent spoofing" actually means

A permanent spoof rewrites the identifiers at the layer they're read from — firmware where possible, kernel-facing shims where firmware refuses. The key words are "at the layer they're read from." A tool that only changes the Windows-facing MAC leaves the NIC's real ROM MAC intact, and Vanguard will read the real one. A tool that only changes the disk's Windows-facing serial leaves the firmware serial intact.

A real permanent spoofer does all of the following in one run:

• Flashes new motherboard / chassis / UUID values into the SMBIOS through the vendor's own signed firmware-update path
• Rewrites disk serials via the SATA/NVMe secure-erase or vendor firmware path
• Registers a locally-administered unicast MAC as an override on every NIC and forces the NIC to advertise it
• Regenerates the registry HWID vectors that Windows can be tricked into keeping across reboots
• On specific boards, rewrites the TPM manufacturer code through a session hook (this one is transient — it re-applies every boot)
• Plants a small trace so it can prove to itself, next launch, that no other spoofer has touched the machine since

The three questions to ask before you buy any spoofer

1. Does it cover the firmware identifiers? If the sales page only says "MAC + disk," it will not survive Vanguard. Firmware identifiers are the ones that stick across reinstalls, so they're the ones the anti-cheat trusts most.
2. Does it cover the anti-cheat you actually play against? Vanguard is the strictest. EAC and BattlEye are looser but not by much. Ricochet is different again — it does not do a permanent server-side HWID ban but it does correlate hardware for repeat offenders.
3. What is the refund policy if it doesn't stick? A vendor that will not refund a failed spoof does not believe in their product. A vendor that ships free support sessions to fix corner-case boards has skin in the game.

← Back to all posts