Promissor Exam Software

[browolf]

seems a bit stupid that we cant have a test account. How are we supposed to know its working properly beforehand?

First time we set it up, we made a mistake somewhere and 100 kids had to abandon their tests.


here's what I've done, I think it'll work, cant see any flaws

created an account esm with domain admin rights.
placed it in a OU beneath normal kids (ie heavily restricted)
changed the shell to be the promissor software

this should mean normal restrictions apply (no desktop icons etc) but they have rights to write to promissor folder (domain admin rights)
but no explorer shell to breach network with
task man already disabled in ctrl alt del dialog (so no loading explorer)
usb sticks dont seem to work either.

we're gonna room at a time logon thru abtutor software. so they wont know the password.

how does this sound?

[jcollings]

Thought they only need read/write access to the share on the folder and c:\program files\promissor on the local machine?

[browolf]

normal users, pupils, dont have write rights to the c:\prog files. so either we go and change the permissions on each computer or we give the user account elevated permissions.

[jcollings]

Same here my thinking was to create some Exam User accounts (with all our usual security bits) - create a group called ALAN Testing - make them a member of that and give that group rights to the appropriate bits of the C drive via GPO

I think I would be nervous of letting a student sit a PC logged in as an administrator - just my thought though and not intended as a criticism.

[Gatt]

This sounds like what we ran over the summer - and was a b*tch to get up and running.. not helped by the fact that SLT gave us about 2 days notice and my technician spent all weekend getting it configured!

IIRC we had to do same - give permissions to the Promissor folder

[plock]

Why not create your exam accounts, upon creation stick them in a security group, and then run a start-up script on all machines to add the security group into the permissions on the required folder.

[DMcCoy]

You really don't mean domain admin rights do you? If you are desperate you should use at most administrator rights for the local machine only. I add a domain group to all the local machines administrators group when I'm making images so I can add and remove ad groups to it to allow only control over the machines. I use different groups for admin and student machines for finer control.

[SYNACK]

You can change the rights on that folder to allow the exam group read/write by using group policy.

GPO > Computer Config > Security Settings > File System

Just add something like %PROGRAMFILES%\promissor and edit the applied permissions for it and its sub folders to give the appropriate group full access then you don't need to give them admin rights.

[browolf]

You can change the rights on that folder to allow the exam group read/write by using group policy.

GPO > Computer Config > Security Settings > File System

Just add something like %PROGRAMFILES%\promissor and edit the applied permissions for it and its sub folders to give the appropriate group full access then you don't need to give them admin rights.

I started doing that but when i set the permissions in the permiss bit
if kept coming up with mycomputername\users and refused to let me use any domain\group things.

so i wasnt sure i could trust that

actually tried it today and it let me add domain\users gonna trial it tomorrow with some kids with the different methods.