Back to Blog
Guides

What Is BattlEye? The Kernel Anti-Cheat Explained

Saturn TeamUpdated October 7, 2026
What Is BattlEye? The Kernel Anti-Cheat Explained
On this page
  1. Who Makes BattlEye
  2. How BattlEye Works
  3. Which Games Use BattlEye
  4. When BattlEye Runs on Your PC
  5. What Data BattlEye Collects
  6. Is BattlEye Safe?
  7. BattlEye Bans: Account, Global and Hardware
  8. BattlEye vs Easy Anti-Cheat and Vanguard
  9. BattlEye FAQ

BattlEye is a kernel-level anti-cheat for online PC games, built by BattlEye Innovations, a German company based in Reutlingen. Bastian Suter founded it in October 2004 as an outside tool for Battlefield Vietnam, and BattlEye says its fully proactive protection went live in February 2015. Today it ships inside games such as DayZ, Arma 3, Destiny 2, War Thunder and Grand Theft Auto Online, and on Steam at least 9 current games carry the store notice "Uses Kernel Level Anti-Cheat: BattlEye".

BattlEye has two jobs. It blocks cheat programs from touching the game while you play, and it bans the accounts of players it catches. Because part of BattlEye runs inside Windows itself, players ask the same three things about it: what it reads, whether it is safe to keep, and whether its bans can follow a PC.

Who Makes BattlEye

BattlEye is made by BattlEye Innovations e.K., a registered German sole proprietorship whose proprietor is still its founder, Bastian Suter. The company's About page tells the history in order. BattlEye began in 2004 as a third-party add-on that server admins and leagues ran on Battlefield Vietnam, then moved to Battlefield 1942 and Battlefield 2. In 2006 the freeware shooter Warsow became the first game to build BattlEye in directly, and the Arma series, S.T.A.L.K.E.R. and the DayZ mod followed.

The big change came between 2014 and 2015. In a February 2015 news post called "A New Dawn", BattlEye explained that it was moving from detection, which punishes cheaters after the damage is done, to protection, which tries to stop the cheat from running at all. That shift brought a dedicated BattlEye launcher and a kernel-mode driver. The same post said plainly that the driver would not make BattlEye a rootkit hiding its own activity. On its About page BattlEye also cites more than 150,000 bans in 15 months in Arma 2: Operation Arrowhead alone.

BattlEye sells to studios, not to players. A publisher licenses it, ships the BattlEye files with the game, and BattlEye's servers then run detection and the global ban list for that game.

How BattlEye Works

BattlEye works in two halves: a client on your PC and a server component on the game's servers. The About page describes the client side as fast, dynamic scanning of the player's system "in user- and kernel-mode", using both specific signatures and heuristic checks. The home page adds that the scanning is controlled and changed from BattlEye's backend, so a cheat maker cannot study one fixed client file and work around it for good.

Diagram of BattlEye's three parts: the BEDaisy.sys driver and BEService on the PC, the BattlEye server that kicks unresponsive clients, and BattlEye's backend that runs detection and the global ban list.

The Kernel Driver and the BattlEye Service

BattlEye is kernel-level because part of it is a Windows driver. BattlEye's own FAQ names the driver file, BEDaisy.sys, in an error message about Windows refusing to load it. A second piece, the BattlEye Service (BEService.exe), installs as a Windows system service and lives in a shared Common Files folder. The game itself starts through a BE Launcher, usually an executable whose name ends in "_BE".

That driver makes BattlEye a kernel-level anti-cheat, the same class of software as Riot Vanguard and Anti-Cheat Expert. Kernel access is the point. A cheat that loads its own driver can hide from any tool that only looks from user mode, so BattlEye watches from the same privilege level.

The same access explains BattlEye's strict list of Windows modes it will not run under. The FAQ says BattlEye refuses to start when Windows runs in test-signing mode or with kernel debugging turned on, and it blocks some hardware tools whose kernel drivers have known security holes. BattlEye's FAQ also notes that a Windows 11 feature called Kernel-mode Hardware-enforced Stack Protection could stop its driver from loading.

Client, Server and the Ban List

On the server side, the BattlEye Server keeps every connected BattlEye Client on a short leash. The About page says the server demands quick, constant replies from each client and kicks any player whose client stops answering. All of this traffic is encrypted and travels inside the game's own network connection, so players never open extra ports. Server owners also get RCon, a remote console for kicking and banning players by hand.

Detection itself does not wait on the server admin or the studio. BattlEye's About page says it does the whole job without input from the developer, and confirmed cheaters land on the global ban list for that game.

Which Games Use BattlEye

BattlEye currently protects a long list of shooters and survival games, and the most reliable public record is Steam's own store notice. Steam store pages carry an anti-cheat field that names the kernel anti-cheat a game installs. We checked the store pages of 17 games on October 7, 2026. These carry the BattlEye notice:

Game Publisher Steam notice
DayZ Bohemia Interactive BattlEye, kernel level
Arma 3 Bohemia Interactive BattlEye, kernel level
Arma Reforger Bohemia Interactive BattlEye, kernel level
Destiny 2 Bungie BattlEye, kernel level
War Thunder Gaijin BattlEye, kernel level
GTA V Enhanced Rockstar Games BattlEye, kernel level
Escape from Tarkov Battlestate Games BattlEye, kernel level
Dune: Awakening Funcom BattlEye, kernel level
Unturned Smartly Dressed Games BattlEye, kernel level

Older lists need care. Wikipedia's list of BattlEye games still names PUBG: Battlegrounds and Fortnite, but the PUBG store page now lists KSS (Krafton Security Services) as its kernel anti-cheat, and Fortnite is an Epic game that uses Easy Anti-Cheat. Rainbow Six Siege was one of BattlEye's best-known partners from 2016 on, yet its Steam page shows no anti-cheat notice at all today, and the same goes for ARK: Survival Evolved. Treat any games list without a date as a history lesson.

Escape from Tarkov shows how the work splits between vendor and studio. Its Steam notice adds that BattlEye "requires manual removal after game uninstall", and the ban figures and detection details for cheats in Escape from Tarkov sit with Battlestate's own reports rather than with BattlEye.

When BattlEye Runs on Your PC

BattlEye runs only while a BattlEye-protected game is running. The BattlEye FAQ says the service "is only ever active" when you play a protected game with BattlEye enabled, and Ubisoft's help page says the same thing about its own games. Close the game and the BattlEye Service stops.

That is a real difference from Riot Vanguard, which Riot describes as "usually an on-boot application" that starts with Windows. Rockstar goes one step further for GTA Online: its BattlEye FAQ says BattlEye only needs to be active for online sessions, and players can switch it off through a setting or launch option for Story Mode. Official Rockstar community roleplay servers do not require BattlEye either.

BattlEye does not always leave with the game, however. Several Steam notices, including those for DayZ, Arma 3, Destiny 2 and Escape from Tarkov, warn that BattlEye needs manual removal after you uninstall the game. The BattlEye FAQ says many games ship an Uninstall_BattlEye.bat file in their BattlEye folder for that purpose, and that some games remove the service on their own.

What Data BattlEye Collects

BattlEye lists the data it may collect in its privacy policy, and Rockstar repeats the same seven items almost word for word in its GTA Online BattlEye FAQ:

  • Your IP address
  • Game identifiers, such as your in-game name and account ID
  • Hardware device information and identifiers, such as serial numbers
  • Information about the running operating system
  • Information about game-related and operating-system-related files and memory
  • Information about running processes, drivers and other executable code
  • File names inside that information, which can include your Windows user name

BattlEye says it follows data minimization, meaning it stores data only when it finds signs of cheat software, so "most users" have nothing stored at all. When a detection happens, the privacy policy says BattlEye usually keeps your IP address, your account or in-game name and "possibly hardware serial information for identification". Those serials come from the same parts that make up the hardware IDs a PC reports, such as the motherboard, disks and network adapter.

Two lists from BattlEye's privacy policy: data BattlEye may collect, such as IP address and hardware serial numbers, and data it says it never sends, such as documents, passwords and memory contents.

Two more lines in the BattlEye privacy policy matter for privacy. BattlEye can send flagged executable code to its servers for review, which it says should never happen to players who run nothing suspicious. And BattlEye may share data with the publisher of the game it protects, so a data request goes to the publisher first.

Is BattlEye Safe?

BattlEye is legitimate anti-cheat software from a registered company, not malware, and installing it with a game from Steam or the publisher is safe in the ordinary sense. The trade-off is trust, because BattlEye runs a driver with full access to Windows.

The BattlEye privacy policy speaks to the spyware fear in plain words. It says BattlEye does not look at, check, transmit or sell your documents, passwords, credit card details or other personal data, and it calls looking at that data pointless for catching cheats. That is the vendor's own word, and the policy names no outside audit. It is in writing, though, in a policy written for EU data protection law.

The technical risk is the one every kernel driver carries. Microsoft's driver documentation explains that all kernel-mode code shares one virtual address space, so a faulty kernel driver is not isolated from Windows, and a crash in one takes down the whole operating system. A bug in any anti-cheat driver can mean a blue screen, and the BattlEye FAQ carries its own entry for blue-screen crashes. Those crashes are a stability risk. They say nothing about spying either way.

Practical points if you want BattlEye on your terms: it only runs with protected games, you can remove the service once you stop playing them, and overlays such as ReShade are allowed unless a developer blocks them. BattlEye's FAQ says it generally bans only for real cheats or tools designed to get around its protection, and it might kick, not ban, for programs such as macro tools.

BattlEye Bans: Account, Global and Hardware

BattlEye bans work at the account level first. The About page describes a global ban system that can be "SteamID/account-based", which means a BattlEye ban follows your game account across every BattlEye-protected server for that game, private servers included.

What a Global Ban Covers

A BattlEye global ban is permanent. BattlEye's support page calls every global ban permanent and says it makes no exceptions, and it lists what does not get anyone banned: using normal programs like overlays, picking up items a cheater spawned, or sharing a server with a cheater. Appeals go through BattlEye's contact page and need the exact Global Ban ID shown in your game, or your account identifier, such as a SteamID. BattlEye also says it will not reveal the evidence behind a ban.

Publishers can add their own penalties on top. Ubisoft says a BattlEye detection can lead to a sanction on your Ubisoft account, and Rockstar says BattlEye findings can mean suspensions or bans across Rockstar titles and services.

Where Hardware Bans Come In

BattlEye's public pages describe account bans, not a blanket hardware ban. The hardware link is quieter: BattlEye collects hardware serial numbers and may store them after a detection "for identification", and the publisher decides what to do with that. Some publishers block the machine on top of the account, and the rules differ game by game, so it pays to read how hardware bans in BattlEye games are written before assuming either way.

Comparison of a BattlEye global ban tied to the account, which stays, a hardware ban some publishers add, which blocks the PC, and an HWID spoofer, which clears the hardware ban with new IDs.

This is the one place Saturn fits. Saturn rewrites the hardware IDs a Windows machine reports. No cheat ships with it, and it hides no program from BattlEye's scans. If a BattlEye game has banned your PC's hardware, Saturn's BattlEye HWID spoofer changes the identifiers that ban is keyed to, including disk, motherboard, CPU, GPU, RAM, MAC address and monitor EDID, so that hardware ban no longer matches the machine. It cannot lift a BattlEye global ban on your account, which stays in place. You pick between two modes. In temporary mode the swapped IDs hold for as long as Saturn stays running, and closing it brings the flagged originals back. Permanent mode writes new IDs to the PC one time and leaves them there. Before buying, you can run Saturn free for 24 hours; signing up takes an email, never a card.

BattlEye vs Easy Anti-Cheat and Vanguard

BattlEye, Easy Anti-Cheat and Riot Vanguard all use kernel drivers, and the clearest difference between them is who owns them and when they start:

Anti-cheat Owner Starts
BattlEye BattlEye Innovations With the game
Easy Anti-Cheat Epic Games With the game
Riot Vanguard Riot Games When Windows boots

BattlEye is the only one of the three run by an independent company, and its home page leans on that with the line "100% independent". Easy Anti-Cheat from Epic belongs to Epic Online Services and protects Fortnite plus many third-party games. Riot's driver is the outlier on timing: it loads at startup before you open a game, and the design of Riot Vanguard's boot-time driver is tied to Valorant and League of Legends.

BattlEye FAQ

Is BattlEye a virus?

No. BattlEye is anti-cheat software from BattlEye Innovations that installs with a game and runs only while that game runs. Security software sometimes blocks it by mistake, which is why the BattlEye FAQ asks players to allow BEService.exe in their antivirus.

Is a BattlEye ban permanent?

Yes. A BattlEye global ban is permanent, and BattlEye says no exceptions are made. The only route back is an appeal with your Global Ban ID, and BattlEye refuses to reverse bans that came from a stolen account or game key.

Can I uninstall BattlEye?

Yes. BattlEye only installs on Windows as a system service, and you can remove it with the Uninstall_BattlEye.bat file in the game's BattlEye folder. Without BattlEye installed, Ubisoft notes, a game that requires it will not launch.

Does BattlEye work on Linux and Steam Deck?

Sometimes. In September 2021 BattlEye said it would support Valve's Proton layer on an opt-in basis, so each developer decides. GTA Online is one game where it does not work: Rockstar says Steam Deck cannot run BattlEye for GTA Online, only Story Mode.

Does Fortnite use BattlEye?

Not today. Fortnite runs Epic's Easy Anti-Cheat. Older lists, including Wikipedia's, still show Fortnite and PUBG as BattlEye games from an earlier period.

Can BattlEye ban your hardware?

BattlEye itself documents account and SteamID bans. It can store hardware serial numbers after a detection, though, and a publisher can choose to block the PC too, so a hardware ban depends on the game's own rules.

Try Saturn free

24 hours. No card needed.

Start Free Trial