We have designated exam machines which we can drop into an exam OU for the duration of the exam period. When combined with exam user logins, these machines are pretty well examproof. It also allows us to block spellcheck via group policy.

Group Policy
Computer Settings
Security Settings
Software Restriction Policies/Additional Rules
Hash Rules

Here you can browse to .exe files or, for spell check blocking, to MSSpell3.dll. I also block calc.exe and mspaint.exe in this way.