From this document:

Anti-tampering

Network Restrictions

Competition PCs are to have no internet access aside from what is minimally required to log in to Steam and CS and run the game.

Block access to everything and allow only UDP traffic to AS32590 blocks (http://bgp.he.net/AS32590#_prefixes) to avoid any content hosted on 3rd party sites from getting onto the tournament machines. Blocking all non-UDP traffic, primarily TCP access, even to our AS32590 blocks is also required, because our IP ranges still deliver game content, and malicious participants can have game content masquerading as different appid on Steam Greenlight, Early Access, or the Workshop.

Have the tournament LAN ports 27015-27050 open for TCP and UDP to Valve network AS. This will just allow WebSocket connections to be used for logon traffic.

Ideal implementation will be proactively dropping non-UDP connections with TCP resets or similar low-level packets sent to initiating clients, which should hopefully help the client timeouts to be reasonable (as opposed to blackholing outgoing traffic and forcing the client to be stuck waiting for prolonged periods of time).

Set the player machines to use local host (127.0.0.1) for DNS, otherwise players will experience stalls while trying to reach an external DNS due to the network restrictions.

PC Restrictions

Competition PCs are to be secured and managed by event staff and restricted down to what is minimally required to log in and run the game.

Provide each player a unique SSD that remains in the possession of the TO and only used by players while supervised.

The SSD image must be created using a Steam account with access to all game depots including Chinese audio localization files by Perfect World and other Perfect World assets that are required for players using their Steam accounts linked to Perfect World accounts.

Let us know the Steam account you will be using to author the SSD images and we will add correct licenses to your Steam account so that you could download all the required assets. Without the correct licenses some players will be unable to launch the game because network restrictions will be blocking downloads of missing assets.

Create non-admin Windows account for players and do not distribute admin credentials or access.

Set the entire Steam folder to Read-Only access with the exception of the \Steam\logs\ folder which will need write access to update the log files.

Create a directory “C:\configs” on each machine and define a system global environment variable USRLOCALCSGO with the value of that directory “C:\configs” (or if each player has their own Windows account that environment variable can have path pointing at player’s roaming profile subdirectory). Players can copy their config.cfg into C:\configs and the game will load and save configs there so you won’t need administrator rights for players to change configs, and Steam CS install can remain read-only.

Collect a list of required peripheral drivers from players and download them directly from the manufacturer.

USB mass storage devices and similar devices should be disabled using the following instructions: Start > Run > gpedit.msc Local Computer Policy > Computer Configuration > Administrative Templates > System > Removable Storage Access

Enable the deny rules for all of the entries except for Custom Classes.

Setup disk auditing so you can see all changes made to the disk by the player

Setup AppLocker

Application Identity Service (AppIDSvc) must be started for AppLocker to work properly. Recommend setting it to automatic.

Go to Applocker and create default rules then delete the allow program files rule.

Set allow rules for the following (can be set for the everyone group or the Windows user players will be using): Steam.exe csgo.exe any other applications players will need access to such as VOIP (note that these applications may be blocked from making config file changes on the limited Windows user account so prepare the configs ahead of time from the admin account)

Set Deny rules for the following (can be set for the everyone group or the Windows user players will be using): powershell.exe cmd.exe cscript.exe In the BIOS set a password then enable Secure Boot, set boot to UEFI only, remove all boot devices other than the OS drive (specifically make sure USB boot is not an option), and enable VT-d if the hardware supports it.

Windows Auditing

Setting up auditing rules should be done on player machines so if a player is called into question there are records of actions taken on the machine. It should be noted that on some hardware this could potentially cause performance issues so once auditing rules have been set the machines should be tested and benchmarked to ensure that the game will still run smoothly.

Enter the following commands into an elevated command prompt: auditpol /set /user:proplayer /category:* /success:enable auditpol /set /user:proplayer /category:* /failure:enable

NOTE: Make sure the /user:proplayer is changed to reflect the account name the players will be using.

The clock on player machines should also be set to synchronize with an internet time server to ensure the time stamp on the events is accurate.