Controlled Assessment : How we did it

[gill]

Hope this helps if you're struggling to work out how to do this.

Controlled Assessment

Different exam boards have different requirements for each subject but in general students need the following:
1. Secure area to store coursework which is only accessible during the supervised session.
2. No access to shared areas or their existing network folder.

Depending on the subject they may also need the following locked down or accessible:
1. Internet access
2. Ability to use a USB pen drive
3. Spell check

How I did this

In active directory I created:

1. A security group called Controlled Assessment and any student taking any controlled assessment was added to this group.
2. A security group called Controlled Assessment subject 200* (we added the year group as we have more than one year group taking part in controlled assessments)
3. An OU called Controlled Assessment
4. Within the Controlled assessment OU create OUs for each subject called Controlled Subject 200*

I created the following GPOs.

1. A GPO for OU Controlled Assessment which applied to every student locking down the usual things like run command etc (you probably already have a GPO which does this)
2. A GPO to lock down internet access
3. A GPO to allow internet access and set browser settings
4. A GPO to lock down access to shared areas

You can create as many GPOs as you need. I found it easier to create separate GPOs which I can reuse every year.

Link the appropriate policy to the OU Controlled subject 200*
e.g. Geography needs internet access but English doesn’t.

Secure Storage

I then created a course work shared area on X drive which was subdivided into year groups and controlled assessment subject groups.

You’ll need to create a log on script so that students in the security groups you created and teachers can see X drive when they log on.

User Accounts

I created student user accounts, one per student per subject e.g. 06SmithAEnglish, and 06SmithAHistory etc
Ensure they are members of OU Controlled Assessment and OU Controlled subject 200*. Add them to any other OUs which you may have set up on your network e.g. “All students” or “domain users” etc

I gave them roaming profiles.

I created a home folder for each student on X drive and used folder redirection to ensure their “My Documents” folder was set up in the right place.

e.g. \\servername\course work$\2006\English Controlled Assessment

I wanted teaching staff to have access to these folders so I un-ticked “grant the user exclusive rights to My Documents”

Folder Permissions

Set the folder permissions so that only those students (and teachers) taking English in Year group 2006 have access to the 2006\English Controlled Assessment folder on X drive

Set permissions on individual student folders so that only the student and teacher have access to the folder.

I then had to log on as each student save a test document and then log off. This created their “My Documents” folder. Set the permissions on this folder so that students and teachers have access. Then log back in and you should now be able to see the test document you created. The teacher should also be able to see the document created in the student’s folder on X drive.

Getting the permissions right is critical so test them to make sure they are secure.

Controlling access to the folders

The easiest way of doing this is to enable all the accounts in AD at the start of the supervised session and disable them again at the end.

You can also use the log on hours feature in AD but it only controls logging on it doesn’t force users to log off.

Spell Check

Don’t waste time trying to block spell check; we couldn’t make it work properly. Every time a user pressed F7 spell check worked! Students who are not permitted to use spell check should use WordPad to complete the assessment.

Blocking Apps and pen drives

I use Net Support software to allow or block individual apps like WordPad and to block USB pen drives.

The software can also be used to block access to the internet.

[SpuffMonkey]

Like it all apart from having to create an account for every student/subject - good grief!

[gill]

That was a bit of a pain but I will try to come up with a way of doing it in a batch file. Fortunately some of our groups were quite small (20 students) but it would be a nightmare if you had 100s of kids!

I'm sure there are lots of techies out there far cleverer than me who will find a better way of doing this but in the absence of any technical guidance from the exam boards I thought others might like to see how we tackled the problem.

[Ully]

I agree that putting in all these extra accounts seems like a nightmare. I personally would rather send them all into a room with pen and paper!

[TheCrust]

We did something along the same lines for our CA students as Gill.

I created a "GRPExamCandidates" group, and created a copy of the main student GPO called "Exam Candidates GPO".

The Exam Candidates GPO redirects student documents folders to another home drive, gives them a different desktop wallpaper (with a "You are under exam conditions!" message in it, as if they didn't need reminding), and a different redirected desktop so access to only the applications we wanted them to have.

Deny permissions were set on both the normal student GPO and the Exam Candidates GPO in such a way that when the student was a member of the usual student groups, the normal GPO applied, but when they were a member of GRPExamCandidates, the exams GPO applied and they were denied access to the normal GPO.

To control this easily and with minimal administrative input, we have a forms-based automation application called UMRA (from Identity und Access management Lsungen, User Management, Password Management, SSO, RBAC, audit, compliance, licenced per-user account in AD) and I wrote a simple application in that that allowed a nominated user - such as the exams officer, or invigilator -to add the students to the exam group, and take them out again afterwards, but you could do it just as easily yourself with AD Users and Computers.

This effectively met all the exam board requirements as far as we could tell - apart from the "students must have individual logons". I don't know quite what they are smoking at the exam boards when they came up with that little gem, but having an individual account for each student for each subject very quickly becomes an administrative nightmare for our network as we run a swipe-card based printing system and each account would need its own print card, not to mention the sheer number of students involved....

We argued that the account itself was actually immaterial as long as the secure area / applications use requirements were met, and by allowing the student to use their normal account (but with these modified settings) it maintained consistency from the perspective of logging on and printing.

As a precaution against students cheating by passing their user details to someone else in school who could log on concurrently, we reset their passwords as they are sitting down to get the CA underway.

Seems to work very well for us.

[alan-d]

We went for the simple solution.

Created accounts such as Exam1, Exam2 etc each locked down as appropriate for the assessment. All accounts can only save to a USB. All students log into the one account (e.g. Exam 1), save to a USB and the teachers collect the USBs in at the end.

[john_robinson001]

We did this a very similar way to you gill, with a couple of slight differences.

Rather than create separate user accounts for each student taking an assessment, we remapped their user accounts to use a different home-folder path. This way, when we're informed that students need to take a controlled assessment, we just change their home folder path to e.g. \\server\controlledassessment$\english. This automatically creates a folder with the right security permissions etc. When they've finished, we put the home folder back to normal.

[Hecate]

We did more or less the same but created a series of exam accounts for each subject - geogexam-01 etc - the staff in charge of the exam allocated the accounts to the pupils and we delegated them (the staff) permission to enable/disable the accounts. This meant that we didn't have to be involved in scheduling sessions. Once we had shown them how to do it the staff were really happy with it.

[jsnetman]

We don't create extra accounts, we just change the path to their home folder move them to an OU setup to heavily restrict the desktop and apps. Only word can be executed as thats all that is required. A shared area also for research docs. When switched back to their original path and OU they don't have access to the home path for the controlled exam.

[bjohnny42]

Howto: Delegate the enable/disable accounts permission in Active Directory « the back room tech

Found the above website to help with enabling the correct permissions for delegation. ***** These users would get a few extra permissions too relating to the account tab and account tab for the user which is worth noting.

[timbo343]

We are going through the controlled assessments at the moment, its a right pain. The way we have done it is to create each user taking a control test with another user for that subject. So in my AD i have the year which they joined... which is their normal account but in a heavily locked down area in AD we have controlled test > {name of subject} > {Groupname}. In here is the users. So we are told when each control test is going ahead i have a number of MMCs open with selected users so i can disable groups of users from the normal account area.

Like i said, its a right pain in the backside and wish these exam boards would think about the implications before setting these rules.... wish there was an easier way.

[apeo]

Has anyone figured out how to block Downloading and Uploading to internet?

Here all the ad config is done by the teacher i.e. i created a hta for them so they can easily select what they want, and the hta configures the ad users.

[jonnykewell1]

Hi thanks for the info, this is exactly the same as what we are doing, but our lessons start at say 9.50 and finnish at 10.50 for example, where as AD only allows it to the nearest hour. We also tend to forget to open the accounts if we are busy around the school, is there any software we can use to add more specific time and account control?

Thanks in Advance.

[gill]

we're finding the same problem, being tied to the office to enable/disable accounts or trying to remember to get back to the office to set things up at the start of a session and most days we have at least one session taking place.

I haven't found any software which can do this, does anyone else know of any?

[SpuffMonkey]

AB Tutor?