+ Post New Thread
Page 1 of 5 12345 LastLast
Results 1 to 15 of 67
How do you do....it? Thread, Controlled Assessment : How we did it in Technical; ...
  1. #1
    gill's Avatar
    Join Date
    Mar 2008
    Posts
    43
    Thank Post
    26
    Thanked 7 Times in 3 Posts
    Rep Power
    15

    Controlled Assessment : How we did it

    Hope this helps if you're struggling to work out how to do this.

    Controlled Assessment

    Different exam boards have different requirements for each subject but in general students need the following:
    1. Secure area to store coursework which is only accessible during the supervised session.
    2. No access to shared areas or their existing network folder.

    Depending on the subject they may also need the following locked down or accessible:
    1. Internet access
    2. Ability to use a USB pen drive
    3. Spell check

    How I did this

    In active directory I created:

    1. A security group called Controlled Assessment and any student taking any controlled assessment was added to this group.
    2. A security group called Controlled Assessment subject 200* (we added the year group as we have more than one year group taking part in controlled assessments)
    3. An OU called Controlled Assessment
    4. Within the Controlled assessment OU create OUs for each subject called Controlled Subject 200*

    I created the following GPOs.

    1. A GPO for OU Controlled Assessment which applied to every student locking down the usual things like run command etc (you probably already have a GPO which does this)
    2. A GPO to lock down internet access
    3. A GPO to allow internet access and set browser settings
    4. A GPO to lock down access to shared areas

    You can create as many GPOs as you need. I found it easier to create separate GPOs which I can reuse every year.

    Link the appropriate policy to the OU Controlled subject 200*
    e.g. Geography needs internet access but English doesn’t.

    Secure Storage

    I then created a course work shared area on X drive which was subdivided into year groups and controlled assessment subject groups.

    You’ll need to create a log on script so that students in the security groups you created and teachers can see X drive when they log on.

    User Accounts

    I created student user accounts, one per student per subject e.g. 06SmithAEnglish, and 06SmithAHistory etc
    Ensure they are members of OU Controlled Assessment and OU Controlled subject 200*. Add them to any other OUs which you may have set up on your network e.g. “All students” or “domain users” etc

    I gave them roaming profiles.

    I created a home folder for each student on X drive and used folder redirection to ensure their “My Documents” folder was set up in the right place.

    e.g. \\servername\course work$\2006\English Controlled Assessment

    I wanted teaching staff to have access to these folders so I un-ticked “grant the user exclusive rights to My Documents”

    Folder Permissions

    Set the folder permissions so that only those students (and teachers) taking English in Year group 2006 have access to the 2006\English Controlled Assessment folder on X drive

    Set permissions on individual student folders so that only the student and teacher have access to the folder.

    I then had to log on as each student save a test document and then log off. This created their “My Documents” folder. Set the permissions on this folder so that students and teachers have access. Then log back in and you should now be able to see the test document you created. The teacher should also be able to see the document created in the student’s folder on X drive.

    Getting the permissions right is critical so test them to make sure they are secure.

    Controlling access to the folders

    The easiest way of doing this is to enable all the accounts in AD at the start of the supervised session and disable them again at the end.

    You can also use the log on hours feature in AD but it only controls logging on it doesn’t force users to log off.

    Spell Check

    Don’t waste time trying to block spell check; we couldn’t make it work properly. Every time a user pressed F7 spell check worked! Students who are not permitted to use spell check should use WordPad to complete the assessment.

    Blocking Apps and pen drives

    I use Net Support software to allow or block individual apps like WordPad and to block USB pen drives.

    The software can also be used to block access to the internet.

  2. 4 Thanks to gill:

    csmith2 (16th May 2011), GrumbleDook (15th October 2010), simpsonj (30th September 2010), SpuffMonkey (17th June 2010)

  3. #2

    SpuffMonkey's Avatar
    Join Date
    Jul 2005
    Posts
    2,240
    Thank Post
    55
    Thanked 278 Times in 186 Posts
    Rep Power
    134
    Like it all apart from having to create an account for every student/subject - good grief!

  4. #3
    gill's Avatar
    Join Date
    Mar 2008
    Posts
    43
    Thank Post
    26
    Thanked 7 Times in 3 Posts
    Rep Power
    15
    That was a bit of a pain but I will try to come up with a way of doing it in a batch file. Fortunately some of our groups were quite small (20 students) but it would be a nightmare if you had 100s of kids!

    I'm sure there are lots of techies out there far cleverer than me who will find a better way of doing this but in the absence of any technical guidance from the exam boards I thought others might like to see how we tackled the problem.

  5. #4

    Join Date
    Jan 2006
    Location
    Luton/Dunstable, BEDS
    Posts
    6
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    I agree that putting in all these extra accounts seems like a nightmare. I personally would rather send them all into a room with pen and paper!

  6. #5

    Join Date
    Dec 2007
    Location
    Derbyshire. Ish.
    Posts
    264
    Thank Post
    29
    Thanked 22 Times in 15 Posts
    Rep Power
    24
    We did something along the same lines for our CA students as Gill.

    I created a "GRPExamCandidates" group, and created a copy of the main student GPO called "Exam Candidates GPO".

    The Exam Candidates GPO redirects student documents folders to another home drive, gives them a different desktop wallpaper (with a "You are under exam conditions!" message in it, as if they didn't need reminding), and a different redirected desktop so access to only the applications we wanted them to have.

    Deny permissions were set on both the normal student GPO and the Exam Candidates GPO in such a way that when the student was a member of the usual student groups, the normal GPO applied, but when they were a member of GRPExamCandidates, the exams GPO applied and they were denied access to the normal GPO.

    To control this easily and with minimal administrative input, we have a forms-based automation application called UMRA (from Identity und Access management Lsungen, User Management, Password Management, SSO, RBAC, audit, compliance, licenced per-user account in AD) and I wrote a simple application in that that allowed a nominated user - such as the exams officer, or invigilator -to add the students to the exam group, and take them out again afterwards, but you could do it just as easily yourself with AD Users and Computers.

    This effectively met all the exam board requirements as far as we could tell - apart from the "students must have individual logons". I don't know quite what they are smoking at the exam boards when they came up with that little gem, but having an individual account for each student for each subject very quickly becomes an administrative nightmare for our network as we run a swipe-card based printing system and each account would need its own print card, not to mention the sheer number of students involved....

    We argued that the account itself was actually immaterial as long as the secure area / applications use requirements were met, and by allowing the student to use their normal account (but with these modified settings) it maintained consistency from the perspective of logging on and printing.

    As a precaution against students cheating by passing their user details to someone else in school who could log on concurrently, we reset their passwords as they are sitting down to get the CA underway.

    Seems to work very well for us.
    Last edited by TheCrust; 14th July 2010 at 10:03 PM.

  7. #6
    alan-d's Avatar
    Join Date
    Aug 2005
    Location
    Sutton Coldfield
    Posts
    2,414
    Thank Post
    360
    Thanked 256 Times in 187 Posts
    Rep Power
    75
    We went for the simple solution.

    Created accounts such as Exam1, Exam2 etc each locked down as appropriate for the assessment. All accounts can only save to a USB. All students log into the one account (e.g. Exam 1), save to a USB and the teachers collect the USBs in at the end.

  8. #7

    Join Date
    Apr 2007
    Location
    Wigan, UK
    Posts
    18
    Thank Post
    5
    Thanked 1 Time in 1 Post
    Rep Power
    0
    We did this a very similar way to you gill, with a couple of slight differences.

    Rather than create separate user accounts for each student taking an assessment, we remapped their user accounts to use a different home-folder path. This way, when we're informed that students need to take a controlled assessment, we just change their home folder path to e.g. \\server\controlledassessment$\english. This automatically creates a folder with the right security permissions etc. When they've finished, we put the home folder back to normal.

  9. #8

    Join Date
    Feb 2006
    Location
    South Cumbria
    Posts
    199
    Thank Post
    26
    Thanked 29 Times in 24 Posts
    Rep Power
    22
    We did more or less the same but created a series of exam accounts for each subject - geogexam-01 etc - the staff in charge of the exam allocated the accounts to the pupils and we delegated them (the staff) permission to enable/disable the accounts. This meant that we didn't have to be involved in scheduling sessions. Once we had shown them how to do it the staff were really happy with it.

  10. Thanks to Hecate from:

    bjohnny42 (10th September 2010)

  11. #9
    jsnetman's Avatar
    Join Date
    Oct 2007
    Posts
    887
    Thank Post
    23
    Thanked 134 Times in 126 Posts
    Rep Power
    40
    We don't create extra accounts, we just change the path to their home folder move them to an OU setup to heavily restrict the desktop and apps. Only word can be executed as thats all that is required. A shared area also for research docs. When switched back to their original path and OU they don't have access to the home path for the controlled exam.

  12. #10
    bjohnny42's Avatar
    Join Date
    Dec 2007
    Posts
    88
    Thank Post
    6
    Thanked 5 Times in 5 Posts
    Rep Power
    14
    Howto: Delegate the enable/disable accounts permission in Active Directory « the back room tech

    Found the above website to help with enabling the correct permissions for delegation. ***** These users would get a few extra permissions too relating to the account tab and account tab for the user which is worth noting.

  13. #11
    timbo343's Avatar
    Join Date
    Dec 2005
    Location
    Leeds/York area, North Yorkshire
    Posts
    3,032
    Thank Post
    305
    Thanked 292 Times in 202 Posts
    Rep Power
    120
    We are going through the controlled assessments at the moment, its a right pain. The way we have done it is to create each user taking a control test with another user for that subject. So in my AD i have the year which they joined... which is their normal account but in a heavily locked down area in AD we have controlled test > {name of subject} > {Groupname}. In here is the users. So we are told when each control test is going ahead i have a number of MMCs open with selected users so i can disable groups of users from the normal account area.

    Like i said, its a right pain in the backside and wish these exam boards would think about the implications before setting these rules.... wish there was an easier way.

  14. #12
    apeo's Avatar
    Join Date
    Sep 2005
    Location
    Lost
    Posts
    1,612
    Thank Post
    95
    Thanked 115 Times in 111 Posts
    Rep Power
    42
    Has anyone figured out how to block Downloading and Uploading to internet?

    Here all the ad config is done by the teacher i.e. i created a hta for them so they can easily select what they want, and the hta configures the ad users.

  15. #13

    Join Date
    Mar 2010
    Location
    Leeds
    Posts
    420
    Thank Post
    80
    Thanked 46 Times in 41 Posts
    Rep Power
    18
    Hi thanks for the info, this is exactly the same as what we are doing, but our lessons start at say 9.50 and finnish at 10.50 for example, where as AD only allows it to the nearest hour. We also tend to forget to open the accounts if we are busy around the school, is there any software we can use to add more specific time and account control?

    Thanks in Advance.

  16. #14
    gill's Avatar
    Join Date
    Mar 2008
    Posts
    43
    Thank Post
    26
    Thanked 7 Times in 3 Posts
    Rep Power
    15
    we're finding the same problem, being tied to the office to enable/disable accounts or trying to remember to get back to the office to set things up at the start of a session and most days we have at least one session taking place.

    I haven't found any software which can do this, does anyone else know of any?

  17. #15

    SpuffMonkey's Avatar
    Join Date
    Jul 2005
    Posts
    2,240
    Thank Post
    55
    Thanked 278 Times in 186 Posts
    Rep Power
    134
    AB Tutor?

SHARE:
+ Post New Thread
Page 1 of 5 12345 LastLast

Similar Threads

  1. Controlled Assesment.
    By Finch7 in forum How do you do....it?
    Replies: 16
    Last Post: 24th February 2010, 10:06 PM
  2. Controlled coursework?
    By joshcoombs in forum How do you do....it?
    Replies: 5
    Last Post: 4th December 2009, 12:56 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •