Running White Light AC checks

Before you start

You need a White Light AC Portal account with active access. Access is time-limited: redeem a license key in the Portal, and redeem another key at any time to extend it — keys stack.

Team members with the Viewer role can open reports but can’t create or revoke PINs.

Issuing a PIN

Create a PIN in the Portal dashboard for each player you want to check. A PIN is 8 characters, shown as XXXX-XXXX, and works exactly once.

• Label — optional. Use the player’s name or in-game ID so the report is easy to find later.
• Expiry — between 1 hour and 7 days (24 hours by default). Unused PINs can be revoked at any time.
• Show results to the player — when on, the player sees findings appear live and the result at the end. When off, the scanner only shows “Securely submitting results…”.
• Deep scan — also streams the USN journal for a fuller file history. It takes longer; use it when a standard scan leaves questions.

Send the PIN to the player together with a link to For players, which explains what the scan does and doesn’t touch.

What the player does

The player opens White Light AC Scanner, enters the PIN and starts the scan. Windows asks for administrator permission. The scan is read-only, runs once and uploads a single report — nothing keeps running afterwards. If you allowed results to be shown, the player can also export their own copy of the report.

As soon as the upload finishes, the report appears in your Portal. The server re-scores it from the raw evidence, so nothing the player’s PC claims about its own verdict is trusted.

Reading a report

The top of every report shows the risk score (0–100), the PC Health score, a letter grade with its risk tier, and the scan’s ID, hardware ID and signature version. Below it, five tiles count findings by severity.

• Findings — sorted most severe first. Open a finding’s evidence to see exactly what produced it: paths, timestamps, registry sources, signature matches.
• PC Health — protection and evidence-integrity checks (see below).
• Timeline — what ran and when, from Prefetch, BAM, UserAssist, event logs and more. Filter by source, path, or “Flagged only”. Rows marked deleted point to files that no longer exist.
• Machine and Accounts — hardware, Windows details, Steam and Rockstar accounts. Matching IDs across your scans reveal alt accounts.
• Modules — which checks ran, how long they took and whether any failed.
• Definitions — the tier, severity and health definitions below, inside the report.

Want to try it? Open the live demo report.

Risk tiers and grades

The grade comes from the findings: their severity and how many there are. Many weak signals never add up to one strong one.

A Low Risk scan with an especially low score is shown as grade A.

Severity levels

PC Health score

PC Health (0–100%) measures how trustworthy the evidence is, across 5 areas: Protection, System Integrity, Evidence Integrity, Panic Button, Game Integrity. A PC with protections switched off or forensic history missing gets a low score — and its scan results deserve more caution, even when few findings appear.

Partial-coverage scans

If the player declines the administrator prompt, the scan still runs, but Windows hides Prefetch, BAM, the Security event log, the USN journal and Defender data from it. The report is clearly labelled Not elevated — partial coverage, and checks that couldn’t run are marked unknown rather than passed.

Making a decision

• Read the evidence behind each high or critical finding — don’t act on the grade alone.
• Look at PC Health and coverage: low health or partial coverage means less evidence was available.
• Check linked accounts and hardware IDs against earlier scans.
• When something is unclear, ask the player about it, or issue a new PIN with deep scan enabled.
• Export the report (HTML or JSON) if you need to keep a record or share it with your team.

White Light AC presents evidence; your staff make the decision under your community’s rules.

Player history and flags

Every report has a Player history card: how many other checks the same PC and game accounts have had, how many failed, across how many communities, and any flags. Open Player lookup in the Portal to search by hardware ID, Steam ID, Rockstar ID or one of your license keys.

• Check history — date and time, community, who ran it (for your own checks: the staff member or PIN), the result and what failed. Tick “Failed checks only” to filter.
• Windows installed / reset — the install date recorded at each check. Reset just before check means Windows was installed within 7 days of the check; Changed since last check means the same PC reported a different install date than last time. Both are common ways to wipe evidence.
• Seen together with — other accounts and PCs that appeared in the same checks. Click one to pivot the lookup.
• Flags — short notes communities attach to a player. Flag only on real evidence and keep the reason factual: other communities see it with your community’s name.

Other communities’ checks appear as summaries; only your own checks open the full report. Lookups are recorded in the audit log.

In-person checks (staff mode)

For checks you run while watching — on stream, in a voice call or at a LAN — staff can sign in to the scanner with their Portal account instead of using a PIN. Results are shown directly in the app and saved to your Portal.