Block Steam and Epic Games at School, Keep the Esports Room Running
PC game stores are a lab computer problem first and a network problem second. A launcher installed on one machine can pull many gigabytes of game files over the school connection and turn a computer lab into a gaming room.
This guide covers how to block Steam and the Epic Games Store on Windows labs, Chromebooks and Wi-Fi, and how to carve out clean exceptions for esports and game design classes.
Three layers of a PC game platform
Steam and Epic are more than websites. Each has a store, a launcher that installs and runs games, and a community around them. Each layer needs a different control.
The store website
Browsing and buying games in a browser. Reachable from any device, including Chromebooks.
- Control: URL blocking and the Gaming category.
The launcher application
A desktop program that installs, updates and runs games, with its own chat and friends list.
- Control: application control, standard user rights, firewall rules.
Community and content
Forums, user reviews, guides, workshop uploads and profiles, many open to anyone.
- Control: domain block on community domains, Gaming and Forums categories.
Cut the store, the community and the download hosts at the lookup
A launcher on a lab PC still has to find its servers by name, and the hosted CIPA filter that we run answers those lookups for your schools. Application control on the PCs stays your job, and the DNS side becomes a switch.
- Store and community sites on Chromebooks are refused by the same Gaming setting.
- The esports room can have its own settings or always-allow entries without touching other schools.
- Lab PCs, Chromebooks and guest phones all use the one DNS setting on the router or firewall.
Why schools block game stores and launchers
The case is usually practical rather than moral. Gaming is a legitimate hobby; it just does not belong on lab computers during the school day.
Bandwidth
Modern games and their updates often run to many gigabytes. One install can compete with a whole building's online testing.
Disk and image drift
Installed games fill lab disks and break the standard image that IT relies on for quick resets.
Mature content
Stores list games with mature ratings and user-generated content that can include material harmful to minors.
Chat and friends
Launchers include messaging and voice with people outside the school, which raises the same concerns as other chat apps.
Purchases
Stores take payments and gift cards. Families do not expect purchases made on a school computer.
Mods and downloads
Unofficial mods and cheat tools from third-party sites are a common malware source.
Age terms
Store accounts have minimum ages, and younger students are often below them.
Lesson time
A game window behind a spreadsheet is the classic lab distraction teachers report.
Chromebooks vs Windows labs: where the risk really is
Typical school Chromebooks cannot run the PC launchers. That shifts the problem rather than removing it.
On Chromebooks
- Store and community websites still open in the browser.
- Android game apps can be installed if Google Play is open to students.
- Browser-based games and cloud gaming sites stream games without installs.
- Controls: Admin console URL blocking, Play set to approved apps only, Gaming category on the device filter.
On Windows lab PCs
- Launchers can be installed if students have install rights.
- Portable copies can run from USB drives or user folders.
- Game downloads use the lab's network connection.
- Controls: application control, standard user accounts, removable storage policy, DNS and firewall rules.
Mixed fleets need two playbooks. A district with Chromebooks for students and Windows machines in labs, libraries and career and technical education rooms should treat them separately. The Chromebook playbook is about websites and apps; the Windows playbook is about install rights, executables and storage. Running only one of them leaves the other wide open.
Teacher laptops in classrooms. Students sometimes use a teacher's Windows laptop at the front of the room. Keep games off staff images too, and lock the screen when the teacher steps away.
If you are working on browser games specifically, see how to block online games on school networks. For Roblox, see blocking Roblox on school Chromebooks.
Domains commonly used by Steam and Epic
Neither company publishes a blocklist for schools, and both use large delivery networks for downloads. These well-known domains are a start; the Gaming category does the long-term work.
| Platform | Domain | Role |
|---|---|---|
| Steam | steampowered.com | Store, accounts and client services |
| Steam | steamcommunity.com | Community, profiles, workshop and chat on the web |
| Steam | steamstatic.com | Images and static content |
| Steam | steamusercontent.com | User uploads and workshop files |
| Steam | valvesoftware.com | Company and support services |
| Epic | epicgames.com | Store, accounts, launcher services and downloads |
| Epic | fortnite.com | Game website and account features |
| Epic | unrealengine.com | Engine site and tools; see the game design note below |
Do not block shared delivery networks. Game downloads often come from large delivery providers that many learning sites also use. Blocking the provider's domain breaks unrelated services. Block the platform domains and let application control stop the launcher.
The Gaming label covers the stores, but the engine site is filed elsewhere
Steam, Epic and several rival stores are labelled Gaming, with the community site adding Social Networking. The Unreal Engine site is filed as Freeware/Software, which matters for the game design room.
| Domain | Categories we hold |
|---|---|
| steampowered.com | Gaming |
| steamcommunity.com | Gaming, Social Networking |
| epicgames.com | Gaming |
| fortnite.com | Gaming |
| unrealengine.com | Freeware/Software |
| itch.io | Gaming |
The blocking quests: step by step
Complete them in order. Menus in management consoles change from time to time, so search for the setting name if a label differs.
Remove install rights on Windows labs
Most launcher installs succeed because the student account is a local administrator, or because the installer writes to the user folder.
- Make every student account a standard user.
- Restrict Microsoft Store installs to approved apps for student devices.
- Reimage or reset lab machines on a schedule so stray installs do not persist.
Add application control
Use your device management tool to block the Steam and Epic launcher executables, or switch to an allow-only list of lab software.
- Block by publisher where your tool supports it, so renamed files are still caught.
- Include user-writable folders in the policy scope.
- Test with a portable copy on a USB drive.
Control removable storage
Portable game copies and launchers on USB drives bypass install rules. Set removable storage to read-only or blocked for student accounts, with an exception process for coursework.
Block the domains and the Gaming category
On your web and DNS filter, block Gaming for student groups and add the platform domains listed above. Check any domain you see in logs with the domain category checker.
Chromebook controls
- In Devices > Chrome > Settings > Users & browsers, add the store and community domains to URL blocking for students.
- In Devices > Chrome > Apps & extensions > Users & browsers, set Google Play to approved apps only.
- Apply the Gaming category on the filter that travels with the device.
See blocking websites on Chromebook with Google Admin for blocklist syntax.
Firewall application rules and bandwidth
Add application rules for both launchers on student and lab networks. Where your policy allows gaming on a special network, add bandwidth limits so a large download cannot saturate the link.
Esports and game design: making clean exceptions
Many schools run esports teams and game design courses. Both may need parts of these platforms. Exceptions work when they are separate, scheduled and supervised.
| Program | What it needs | How to allow it |
|---|---|---|
| Esports team | Specific launchers and game services for the titles the league uses | Dedicated PCs on their own network segment and filter policy, allowed during practice and match times only. |
| Game design course | Engine downloads, sign-in and learning resources, sometimes from Epic's services | A lab policy that allows the engine's domains while the store and game sites stay blocked. |
| Computer science club | Usually none of the stores | Standard student policy; allow specific developer resources by request. |
Good exception habits
- Coach or teacher owns the accounts used on school PCs.
- Rules switch on by schedule and off afterwards.
- Chat features are limited to team members where the platform allows.
- The exception is written into policy with an owner and review date.
Habits to avoid
- Allowing launchers on the general student network.
- Students using personal store accounts on school machines.
- An open-ended exception nobody reviews.
- Esports PCs that double as regular lab computers.
Policy wording and lab hygiene
Technical rules hold up better when the policy says the same thing in plain words, and when lab machines return to a known state every day.
Sample acceptable use wording
- "Students may not install, run or download games, game launchers or game stores on district computers or networks."
- "Approved programs, such as esports and game design courses, use district-managed accounts on designated equipment under staff supervision."
- "Attempts to bypass filtering or application controls are a breach of this policy."
Lab hygiene routine
- Reset student profiles at sign-out so downloaded files do not persist.
- Review application control logs weekly for blocked launch attempts.
- Rebuild the lab image each term and remove any software no course needs.
- Keep a short list of approved software per lab, owned by the lead teacher.
Our acceptable use policy guide for schools and guide to implementing web filtering in schools show how these rules fit into the wider policy set.
Off-campus coverage
Take-home devices are mostly Chromebooks, so the off-campus question is about the store websites and game apps, not launchers.
Device controls
Admin console URL blocking, Play app settings and a device filtering extension or agent follow the Chromebook home.
Network controls
The school DNS filter, firewall application rules and bandwidth limits stop at the school network.
School hours or always
Many districts block gaming during school hours only on take-home devices, but keep safety categories blocked at all times.
For the full approach, read enforcing CIPA on off-campus student devices and Chromebook 1:1 device filtering. Windows laptops that go home need the same application control policy as lab PCs.
Bypass handling
These are the patterns IT teams see in labs and logs. Each one maps to a control rather than to a list of sites.
| Pattern | Sign | Control |
|---|---|---|
| Portable launcher on USB | Unknown executable started from removable media | Application control and removable storage policy. |
| Install to user folder | New program files in the student profile | Application control that covers user-writable paths; profile reset at sign-out. |
| Cloud gaming in the browser | Long, high-bandwidth video-like sessions to gaming sites | Gaming category; cloud gaming sites are categorized as gaming. |
| Proxy or VPN | Traffic to anonymizer services | VPN / Proxy / Anonymizers category and extension restrictions. |
| Esports network hopping | Student devices joining the esports segment | Network access control or separate credentials for that segment. |
A tunnel does not carry a game download past the filter
VPN / Proxy / Anonymizers is part of the CIPA preset, and public encrypted DNS and browser settings that skip the filter are blocked by default. Staff exceptions use a logged PIN of 15, 30 or 60 minutes.
Testing checklist
Test from a student account on each device type. Keep the results with your annual filtering review.
Run the full list at the start of each school year, after every lab reimage, and whenever you change application control or filter groups. A test that passed in September can fail after a new image adds a browser or changes user rights.
- The Steam store website shows the block page on a student Chromebook.
- The Epic Games Store website shows the block page.
- Steam community pages are blocked.
- The Steam installer will not run on a lab PC as a student.
- The Epic launcher installer will not run as a student.
- A portable launcher on a USB drive is blocked by application control.
- A cloud gaming site is blocked by the Gaming category.
- Esports PCs can reach the required services during practice times only.
- The game design lab can sign in to the engine tools.
- Filter and application control logs record each attempt.
Then run the school web filter test to confirm the wider category set from the same student device.
Communicating with parents
Families of esports players and game design students will want to know why some students have access and others do not.
For all families
- Game stores and launchers are blocked on school computers and school Wi-Fi.
- The reasons are learning time, network capacity and content not suited to all ages.
- Home devices and home networks are not affected.
For esports families
- Team PCs run on a separate, supervised network during practice.
- The coach manages the accounts used on school equipment.
- Students should not use personal store accounts or payment details on school PCs.
Keeping the Gaming category current
New game sites, launchers and cloud gaming services appear every month. A category database handles that churn for you.
120M domains
Categorized and reviewed, with the top 20 million covering 99.99% of traffic.
Daily new domains
About 300,000 categorized every day, rechecked after a week and a month.
58 categories
Gaming, Forums, File Sharing/P2P and the CIPA set in one file.
Runs on-premise
Files run inside your own systems, with a lookup API included with licences.
Read more about the category database, the web filtering categories taxonomy and our guide on allowing Minecraft Education while blocking the consumer game.
Game stores blocked: lab tools alone or with a hosted DNS filter
Application control on Windows stays necessary, and this table covers the name-lookup side.
| Layer | Lab and console tools | Hosted CIPA filter |
|---|---|---|
| Store websites | URL entries per platform | Gaming category |
| Community and workshop hosts | More entries you must find | Reached through their category labels |
| Launcher application on a PC | Application control and install rights | Cannot stop a program, only its lookups |
| Esports and design rooms | A separate policy to maintain | Separate settings and always-allow entries per school |
| Guest and student Wi-Fi | Firewall profile | One DNS setting on the router or firewall |
| Evidence for reviewers | Exports from several tools | Activity reports, policy record and log export |
FAQ: Steam and Epic Games at school
Can students run Steam or the Epic Games Launcher on school Chromebooks?
Typical school Chromebooks cannot run the PC launchers. The realistic risks on Chromebooks are the store websites, community pages, Android game apps and browser-based or cloud gaming sites, which URL blocking, Play controls and the Gaming category cover.
Our esports team needs Steam. How do we allow it safely?
Put esports PCs on their own network segment with their own filter policy that allows the required launchers, and keep the block on every other student network and device. Limit access to scheduled practice times and supervised accounts.
Will blocking Epic Games break Unreal Engine for our game design class?
It can, because Unreal Engine tools sign in and download through Epic's services. Give the game design lab a separate policy that allows the engine's domains, and keep the store and Fortnite blocked.
Is blocking the domains enough on Windows labs?
No. Add application control so the launchers cannot be installed or run, keep students as standard users, and restrict removable storage so portable copies cannot be started.
Do we need to block Steam on staff computers?
Usually not by rule, but staff devices should still not have games installed. Most districts handle staff through the acceptable use policy and standard software lists rather than a filter block.
How do we spot launcher traffic we have missed?
Look in firewall and DNS logs for repeated connections to gaming domains from lab networks, and in application control logs for blocked executables. A spike in download volume from one lab machine is another sign.
What about game streaming and video of games?
Watching game videos is a separate question, covered by your streaming rules. Cloud gaming, where the game itself runs remotely and streams to the browser, falls under the Gaming category.
Are game stores a CIPA issue?
Partly. Stores list games with mature ratings and community pages with user content, which can include material harmful to minors. Most districts also block them for bandwidth and focus, which are local policy reasons.
Pricing is set by the number of schools and devices, and our quote follows inside one business day. A pilot on one lab or site lets you see the game store blocks and the reports before you go further.
Talk to us about your district
Tell us about your labs, Chromebooks and esports setup. We will show how category data keeps gaming blocked where it should be and open where you decide.
Steam is a trademark of Valve Corporation. Epic Games, Fortnite and Unreal Engine are trademarks of Epic Games, Inc. Google, Chromebook, ChromeOS and Google Play are trademarks of Google LLC. Microsoft and Windows are trademarks of Microsoft Corporation. These names are used here only to identify the products discussed. CIPA Web Filtering is not affiliated with, sponsored or endorsed by these companies.