Automating controlled assessment account timings

[Shaun_Dark_Lord]

Hi All

 

Just wanted to share this in case it saves someone else a bit of work.

 

My predecessor here had been using login hours to control when user accounts could be used for controlled assessments. As our lessons don't start/end on the hour, this potentially gave the students extra time.

 

So I decided to have a play with powershell to try and come up with something better. I wanted a script that would disable all accounts in a particular OU, and also log them out.

 

I found this post by Jeffery Hicks which is a fairly simple method of using logon/logoff scripts to track where your users are. This worked great, and required only a small change to line 24 to both the login and logout scripts to record the info I needed. I changed the login script line 24 to '$note = $env:computername' so that just the computer name was recorded, and the logout script line to '$note = "NA"' so that my script would ignore clients that were already logged off.

 

I then cobbled together these;

 

#EnableAccounts
Import-Module ActiveDirectory

Get-ADUser -Filter 'Name -like "*"' `
 -SearchBase "OU=Year 11 Computer Science 2017,OU=Controlled Assessment,OU=Students,OU=CCW Users,DC=mydomain,DC=sch,DC=uk" | Enable-ADAccount

 

#DisableAccountsAndLogoutClients
#Set the search OU
$OU = "OU=Year 11 Computer Science 2017,OU=Controlled Assessment,OU=Students,OU=CCW Users,DC=mydomain,DC=sch,DC=uk"

Import-Module ActiveDirectory

# Get list of users
$UserList = Get-ADUser -SearchBase $OU -Filter *

foreach ($User in $UserList){
   
   $CurrentUserDetails = Get-ADuser -Identity $User -Properties * # Grab all user properties
   $Computer = $CurrentUserDetails.info # Set Computer variable to value of user info
   Disable-ADAccount -Identity $User # Disable User account
   write-host Account $User has been disabled.
   IF (($Computer -eq 'NA') -or (!$Computer)) # Check whether user has computer name in info field
       {
           write-host User not logged in
       } ELSE
       {
           write-host Testing connection to workstation $Computer
           IF (Test-Connection -ComputerName $Computer -Count 1 -Quiet) # Ping the computer
           { 
               (gwmi win32_operatingsystem -ComputerName $Computer).Win32Shutdown(4) # Force log off the computer
               write-host $Computer Logged Off 
           } ELSE 
           { 
           write-host workstation already logged off
       }
   }
   $info = "NA" #define a string to indicate status
   Set-ADUser -Identity $User -Replace @{info="$info"} #update the Info user property
   ;
}

 

I have the first scheduled to run a minute before the assessment is due to start and the second to run a minute after the assessment ends.

 

I hope someone else finds it useful, and if anyone can suggest any improvements I'd love to hear them.