Allowing ICT teachers to restrict login hours for controlled assessment accounts

[gwendes]

Had a request for 100 new accounts to only be used for controlled assessments. Anyone done similar, or know of a way I could grant the ICT teachers permission to enable and disable these accounts - without giving them access to (much) else! Cheers!

[foofighterjim]

Not a particularly elegant solution but we don't give the teachers any access. Instead they send in a helpdesk request to change the password at the end of the Controlled Assessment lesson, students then can't access the area until the teacher tells them what the password is at the start of the next session.

[flyinghaggis]

We're looking to do something similar here. It's not setup yet but my first thought was to create a custom Active Directory Task-pad and give computing staff permissions to enable/disable the accounts

 

https://social.technet.microsoft.com/wiki/contents/articles/2816.how-to-create-custom-mmc-and-add-taskpad.aspx

[NB9457]

We're looking to do something similar here. It's not setup yet but my first thought was to create a custom Active Directory Task-pad and give computing staff permissions to enable/disable the accounts

 

https://social.technet.microsoft.com/wiki/contents/articles/2816.how-to-create-custom-mmc-and-add-taskpad.aspx

 

Exactly what we did, delegate control via a group and create a taskpad to disable accounts

[KibosJ]

I've created the accounts and set a generic password for them that only the teacher knows, so the teacher will log the users in before the accounts are used.

[Boredguy]

We installed the RSAT tool on the teachers workstations and created a MMC shortcut that was limited to the OU where the Controlled Assessment accounts are in the AD.

We then deligated access rights within AD for enabling and disabling accounts to the specific teachers. It's worked well for the last few years.

[gwendes]

Thanks everyone. Remembered that staff are familiar with the AD Account Reset Tool (Cjwdev) and that can enable and disable accounts. All sorted

[gwendes]

Not a particularly elegant solution but we don't give the teachers any access. Instead they send in a helpdesk request to change the password at the end of the Controlled Assessment lesson, students then can't access the area until the teacher tells them what the password is at the start of the next session.

 

This has grown from 30 to 110 accounts. We used to just use Logon Hours but so many students need to work at unusual times that the workload was getting silly for such a simple task. Using Cjwdev AD Account Reset Tool to allow staff enable/disable without much else AD access now.

[Sylv3r]

We do the same as @foofighterjim

[Fazza]

We just restricted the hours of when the accounts would be used and they have to accept a disclaimer that says they agree to only use the accounts for a certain amount of time etc.

[kennysarmy]

We allow the students to manage their own passwords but only the class teacher can request the accounts get enabled, once the lesson finishes we just disable the account.

We also set the "account expires at the end of..." date to the same day so even if we can't disable manually they can't use it past the end of the school day.

 

- - - Updated - - -

 

We allow the students to manage their own passwords but only the class teacher can request the accounts get enabled, once the lesson finishes we just disable the account.

We also set the "account expires at the end of..." date to the same day so even if we can't disable manually they can't use it past the end of the school day.

[CHU]

We have Impero, created a user group of the new CA accounts and the teacher locks/unlocks the group at lessons. We also use it for banning USB and Internet for the group. The logging side will also allow us to see if someone attempts to use it outside of lessons.

[friendlytechnician]

CHU - would you mind sharing with me how you did this. We use Impero too and I've been asked to create a CA group. Doing it through AD is possible but painful.

Do exam boards have any guidance on how sysadmins are supposed to do this or does it just happen?

[CHU]

Each student who is CA has been given a second account, I used username_CA so they all know their logins. I have the new CA accounts under an OU within Students, but they're also in a AD group so that I can assign GPO's to them. In Impero then you just create a user group based on that AD group and when any user signs in they are under control of that group.

 

 

CHU - would you mind sharing with me how you did this. We use Impero too and I've been asked to create a CA group. Doing it through AD is possible but painful.

Do exam boards have any guidance on how sysadmins are supposed to do this or does it just happen?

[mcoyne]

Hi guys,

 

Apologies that I didn't chip on this a bit earlier. I've done quite a bit of work around CAs over the years and I have done something very similar to what you guys have described here, especially with RSAT and delegated permissions in AD. However, I've taken it a bit further using a spreadsheet with Macros that generates batch scripts to seriously streamline the setup process, and batch scripts that allow staff to easily "open" and "close" the sessions. I have attached the files that will support you in setting this up for yourself if it is of interest.

 

Cheers,

Mike

 

CAs.zip