Controlled Assessment Rules

[ITGURU]

Hi

 

We've got some upcoming IT controlled assessments using Python.

 

The rules state that the students must NOT have internet access which isn't an issue as we can disable it.

 

However, do they need a separate login so they CANNOT access their own user space and network drives, as this will have their day to day work in?

 

Thanks.

[RichCowell]

I've created a set of accounts for all the classes doing Controlled Assessments - so some students have 3 or 4 accounts...

 

Some are allowed internet access for research, others aren't...

 

For the ones that aren't I've just blocked the exe's in a GPO on those OU's... I've given the teachers access to enable/disable the CA accounts in their class(es) through AD just on the respective OU...

 

For the ones that are I've created rules in Impero so we can control the Internet and block it easily if/when necessary...

 

Works really well for us - I've been doing that for about 5 years now (or since shortly after the CA's started, whenever that was)...

 

It's a bit of a faff to do all the accounts, but is the only logical way of making sure they can't access that work any other time...

[ITGURU]

I've created a set of accounts for all the classes doing Controlled Assessments - so some students have 3 or 4 accounts...

 

Some are allowed internet access for research, others aren't...

 

For the ones that aren't I've just blocked the exe's in a GPO on those OU's... I've given the teachers access to enable/disable the CA accounts in their class(es) through AD just on the respective OU...

 

For the ones that are I've created rules in Impero so we can control the Internet and block it easily if/when necessary...

 

Works really well for us - I've been doing that for about 5 years now (or since shortly after the CA's started, whenever that was)...

 

It's a bit of a faff to do all the accounts, but is the only logical way of making sure they can't access that work any other time...

 

So they should only have access to a network drive which contains the files necessary for the controlled assessment and teachers have asked if they would be able to access their classwork but I assumed that this isn't allowed either...is that right?

[RichCowell]

So they should only have access to a network drive which contains the files necessary for the controlled assessment and teachers have asked if they would be able to access their classwork but I assumed that this isn't allowed either...is that right?

 

Yes - depending on the subject - they shouldn't be able to access existing work, or access the work created in the controlled assessment lessons outside those lessons... When they log on with their CA accounts, the only network drive they have is their Home Drive...

[ITGURU]

Yes - depending on the subject - they shouldn't be able to access existing work, or access the work created in the controlled assessment lessons outside those lessons... When they log on with their CA accounts, the only network drive they have is their Home Drive...

 

Well that is just it, depending on the Subject. The rules don't state whether or not they can, so I say they can't but the teacher says they can..!

[RichCowell]

Well that is just it, depending on the Subject. The rules don't state whether or not they can, so I say they can't but the teacher says they can..!

 

It's the Exams Officer / Head that's responsible at the end of the day, so ask the Exams Officer for more information - it should state somewhere officially what they need...

 

I think ICT and Business Studies here are the only ones that have been allowed internet access...

[CyberNerd]

Some of the rules are quite insane.

There are certain exams which DO let you have access to pre-prepared material, but do NOT let you research live (art I think is one).

So In these exams; home drives are fine, but internet is not. Exam boards haven't really woken up to the fact that many students homedrives are on the internet.

 

The analogy would be that you are allowed to bring the entire British Library into the exam, but you are not allowed to take the exam in the library.

[timbo343]

I have created seperate accounts which are enabled only when a teacher asks for them. Then their normal account is deactived whilst this one is in use.

[zag]

I setup exam1 to exam100 a few years ago for another online test and just use that. Internet is disabled and the accounts have no user areas.

 

I just re-enable them when they are needed. Most of the time they stay disabled.

[mavhc]

Hmm, considering pupils have to do multiple controlled assessments at the same time, I wonder if a script to alter their home directories would be useful.

 

You'd need a list of pupils and times... saves creating new accounts, and passwords, and mapping those to pupils...

 

11:30, time for ICT CA for pupils x,y,z, redirect H:\ to \\school.local\share$\building\pupils\ca\ict\%username%

12:30, end of ICT CA, redirect back

13:30, Art CA, redirect to \pupil\ca\art\%username%

14:30, end of Art, redirect back.

 

What issues can people see with this?

[RichCowell]

Hmm, considering pupils have to do multiple controlled assessments at the same time, I wonder if a script to alter their home directories would be useful.

 

You'd need a list of pupils and times... saves creating new accounts, and passwords, and mapping those to pupils...

 

11:30, time for ICT CA for pupils x,y,z, redirect H:\ to \\school.local\share$\building\pupils\ca\ict\%username%

12:30, end of ICT CA, redirect back

13:30, Art CA, redirect to \pupil\ca\art\%username%

14:30, end of Art, redirect back.

 

What issues can people see with this?

 

Doesn't sound too bad, but two possible issues that spring to mind are: Staff telling you what times the lessons on... extra sessions they've had to have at other times...

 

Creating a new set of accounts only takes a few minutes though, all with the same password, forced to refresh when logged onto initially... it puts the control back to the teachers that way if they're responsible for disabling & enabling the accounts, but they've not complained about that here, installed RSAT on the teacher PCs in the suites and it all works really well...

[mavhc]

Doesn't sound too bad, but two possible issues that spring to mind are: Staff telling you what times the lessons on... extra sessions they've had to have at other times...

 

Creating a new set of accounts only takes a few minutes though, all with the same password, forced to refresh when logged onto initially... it puts the control back to the teachers that way if they're responsible for disabling & enabling the accounts, but they've not complained about that here, installed RSAT on the teacher PCs in the suites and it all works really well...

 

So you give out exam001 to exam040 to art teacher, and then look after which pupils has which account and the password? Do you wipe the home drives before giving them out again next year?

 

One issue would be making sure they're not already logged in when the script is run I suppose. Wonder if the art teacher could initialize it, IIS webpage with staff only permissions and buttons to click ArtGroup CA ON ArtGroup CA OFF perhaps

[RichCowell]

So you give out exam001 to exam040 to art teacher, and then look after which pupils has which account and the password? Do you wipe the home drives before giving them out again next year?

 

One issue would be making sure they're not already logged in when the script is run I suppose. Wonder if the art teacher could initialize it, IIS webpage with staff only permissions and buttons to click ArtGroup CA ON ArtGroup CA OFF perhaps

 

No, I create a set of unique accounts for each class... So they could end up with a few:

 

11JBloggs

BS11JBloggs

ICT11JBloggs

His11JBloggs

 

Then they all have their own unique home drives... accounts are deleted when they leave.

[mdrabble]

Hmm, considering pupils have to do multiple controlled assessments at the same time, I wonder if a script to alter their home directories would be useful.

 

You'd need a list of pupils and times... saves creating new accounts, and passwords, and mapping those to pupils...

 

11:30, time for ICT CA for pupils x,y,z, redirect H:\ to \\school.local\share$\building\pupils\ca\ict\%username%

12:30, end of ICT CA, redirect back

13:30, Art CA, redirect to \pupil\ca\art\%username%

14:30, end of Art, redirect back.

 

What issues can people see with this?

 

That was how the CA accounts were done here when I arrived - but started causing issues when some students were not doing CA work so had to manually change them back to normal accounts.

 

From this Sept I have created separate accounts so in as Username.IT for IT CA groups and .HI for History etc.

 

Have GPOs in place which block USB access and also block internet access should it need to be.

 

Accounts are turned on and off at the teachers request.

[mavhc]

Do you have copies of the scripts that were used, if any?

[mdrabble]

Do you have copies of the scripts that were used, if any?

 

Used AD groups and GPO settings for the redirections - Was a pain in the rear to manually put users into AD Groups for subjects/classes unless you find a method of automating it. - Plus gave me a headache thinking how it was set up which is my I opted for simpler setup - IMO

 

Students into groups as per SIMS Class Code - 11D/Art, etc

 

Student Class groups were then Added/Removed to CA Groups which had the GPO settings applied to them.

 

I hope that all makes sense.

[Guest obsidianpillar]

The respective exam board will have their own guidelines. However, generally speaking I'd consider how generic you want the accounts to be. Do you want "exam1"or do you want "JSmithEnglish"? Choose what fits your environment best. To the overall configuration I'd do the following.

 

* Create an OU for all of your Exam Account objects. Disable Group Policy inheritance.

 

* Create Sub OU's for all the subjects that require Exam Accounts e.g. History, English etc.

 

* Apply a base policy to the OU with all the settings you want to be reflected on all accounts. Example could be Desktop Wallpaper that would be recognisable if students were logging onto their accounts outside of the lessons. I know that some teachers don't disable them after the end of the lessons for whatever reason. Additionally, create a script (or PM me for mine) that writes their login and logoff times to a text file as it helps teachers calculate how much time students have had (+ 25% extra for Ed-Psych students) and additionally can be presented to the Exam Board should their be any question over how long students have had. <--- Optional, however worked well previously.

 

* Create respective policies for the subjects in their relevant OU. Eg if English can't have internet, either create or link an existing GPO (if you have one) that disables internet by setting the proxy to 127.0.0.1.

 

* Create a new folder within your existing User Data area for your Exam Accounts.

 

* Create new folders for the subjects for where the subjects' Home Folders will be created.

 

* Create a new user object and customise it with your Home Drive preferences, security groups etc for each subject.

 

* Create a policy to only allow programs that the user requires for their controlled assessment using "Run Only specified windows applications" and add the .exe of their required programs to it. This (from experience) is easier than creating a software restriction policy and works just as well.

 

* Customise programs eg Office to the exam prerequisite requirements e.g. Remove Spell Check for English CA's.

 

* Apply relevant Folder Redirection to ensure that there is no risk of loss of work and that all work is being directed into the Home Drive. If the controlled assessments are being conducted on desktops disable Offline Files!

 

* Test your environment with all of your user objects, creating a test user for every OU created and checklist it against what's meant to happen in Group Policy and ensure that it's complying with the Exam Board's guidelines.

 

* Extra: You could go as far as setting the shell to whichever program you are needing Students to use (e.g. WordPad) however I have never done this and have had no problems without changing this setting.

 

 

Hope I've explained it well enough! Any questions, feel free to send me a PM.

 

Best,

Tom

Edited March 13, 2016 by obsidianpillar
Spelling Error.

[markwilfan]

I have a Gpo to turn off spell check and the gubbins in office if that would be helpful. We found even in 2016 students struggle to save docs still lol so we've had to use office to be able to autosave