Exams, disabling and re-enabling accounts

[StAwash]

Hi,

 

I have a limited access to many of the controls behind the scenes to the school, so you'll have to bear with me. It's a slow handover due to the nature of the previous tech and myself.

Throw all your suggestions/ways you manage this anyway! Once I have full control I might change the methodologies as I advance through. But on a reply by reply nature I'll let you know how much control I have, and then you guys will work out I literally practically have very little influence.

 

We have exams coming up. Some students are using laptops for the exams, and we intend to block all applications apart from Word. I pushed for Wordpad, considering its deft deaf nature to spelling and grammar, it seems quiet apt. We've been told we HAVE to use Word.

Anyway, that bit was/is easy, Applockering everything down per user, affect only exam pupil user.

 

We would also like to disable their actual account(s) on the day/time of the exam. Now I can set up a schedule in ADUC per user, however that is for a week. I don't want to sit at the computer first thing Monday mornings setting these up for the students.

My other problem with the above is some exams don't run for the full hour. There are no fine grain controls in the scheduling process in ADUC though.

 

I thought about PowerShell, at x time push in and disable the student(s) real account(s), and at y time push in and re-enable the account(s). This requires me to run a computer at all times, mostly because I don't have access. But this is do-able.

 

 

Are there any other ways to accomplish the same actions without the need to be running an admin machine all day?

 

As an aside, is there a way to disable Word's spelling/grammar module, I.E. I'm thinking disable an EXE or DLL file from running?

[robyholmes]

Hi,

 

I have a limited access to many of the controls behind the scenes to the school, so you'll have to bear with me. It's a slow handover due to the nature of the previous tech and myself.

Throw all your suggestions/ways you manage this anyway! Once I have full control I might change the methodologies as I advance through. But on a reply by reply nature I'll let you know how much control I have, and then you guys will work out I literally practically have very little influence.

 

We have exams coming up. Some students are using laptops for the exams, and we intend to block all applications apart from Word. I pushed for Wordpad, considering its deft deaf nature to spelling and grammar, it seems quiet apt. We've been told we HAVE to use Word.

Anyway, that bit was/is easy, Applockering everything down per user, affect only exam pupil user.

 

We would also like to disable their actual account(s) on the day/time of the exam. Now I can set up a schedule in ADUC per user, however that is for a week. I don't want to sit at the computer first thing Monday mornings setting these up for the students.

My other problem with the above is some exams don't run for the full hour. There are no fine grain controls in the scheduling process in ADUC though.

 

I thought about PowerShell, at x time push in and disable the student(s) real account(s), and at y time push in and re-enable the account(s). This requires me to run a computer at all times, mostly because I don't have access. But this is do-able.

 

 

Are there any other ways to accomplish the same actions without the need to be running an admin machine all day?

 

As an aside, is there a way to disable Word's spelling/grammar module, I.E. I'm thinking disable an EXE or DLL file from running?

 

It's not Word, but look at ExamWritePad on this forum. It's been designed for this very reason and the number of options you can set to make it work for you is amazing! It's made providing laptops for exams so much easier. Best feature of all is it autosaves every minute (Configurable, of course)

 

We then log laptops on before the exam, ExamWritePad opens full screen with a password to exit it.

[gregray]

Does your school have chromebooks at all?

[StAwash]

It's not Word, but look at ExamWritePad on this forum. It's been designed for this very reason and the number of options you can set to make it work for you is amazing! It's made providing laptops for exams so much easier. Best feature of all is it autosaves every minute (Configurable, of course)

 

We then log laptops on before the exam, ExamWritePad opens full screen with a password to exit it.

Fantastic. Little late to implement this year around I think, but thanks so much!

[StAwash]

Luckily(?) not.

[clareq]

Do you have access to GPOs? You can disable the spell checker that way. With regards to accounts - how about scheduled tasks to enable and disable accounts?

enable:

dsquery user | dsmod user -disabled no

disable:

dsquery user | dsmod user -disabled yes

[CHiLL]

Are they specific laptops used only for exams? If so, you could look at possibly denying certain user groups from logging onto the laptops, such as "All Students" or "Intake 2021", (or whatever you've called your groups) etc. That way they can't use their regular domain accounts. I haven't done this myself and now I've thought about it, I might look at implementing that. Since I haven't done it yet, I don't know exactly how to go about it, but I'm sure it would be possible.

[thimon]

+1 to CHiLL's response. Via GPO we only allow our exam AD accounts to sign into exam laptops, this stops students from sneakily signing into them with their own accounts. If they try to login with their own accounts at the Windows logon screen they get an error message.

[jthompson]

Yes, if you have laptops that are being set aside exclusively for use in exams, in a GPO targeted at those computers, add your student security group(s) as needed to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> Deny log on locally.

 

If that doesn't quite suit, then you could possibly look at using that same GPO option but with a new security group, and a scheduled task to script the adding and removing of users to and from that new group. If a user is in the group, they're prevented from signing in to the computers under the scope of the GPO, but if they're not in that group, they can use the computer as normal. That will allow those students to still be able to use their accounts on computers elsewhere if you happen to mess up the timing.

 

As for disabling all of the various proofing tools in MS Office apps, that can be done entirely by using GPOs targeted as users. The GPO options needed are sprayed all of ther the place a bit though - there isn't one master switch, so to speak. I did have a list somewhere that we used for Office 2016, but I can't find it now. We've been using ExamWritePad successfully for a few years, so haven't needed the Office lockdown policy. Definitely one to investigate for the future.

Edited May 6, 2022 by jthompson

[StAwash]

Do you have access to GPOs? You can disable the spell checker that way. With regards to accounts - how about scheduled tasks to enable and disable accounts?

enable:

 

disable:

 

I don't have direct access to GPO's yet, but can definitely throw out a request and see what he says.

 

Otherwise I was worried it would fall down to scheduled tasks. It just means I'm going to have to set up a PC to do the automation/scheduling.

Edited May 6, 2022 by StAwash

[StAwash]

Are they specific laptops used only for exams? If so, you could look at possibly denying certain user groups from logging onto the laptops, such as "All Students" or "Intake 2021", (or whatever you've called your groups) etc. That way they can't use their regular domain accounts. I haven't done this myself and now I've thought about it, I might look at implementing that. Since I haven't done it yet, I don't know exactly how to go about it, but I'm sure it would be possible.

+1 to CHiLL's response. Via GPO we only allow our exam AD accounts to sign into exam laptops, this stops students from sneakily signing into them with their own accounts. If they try to login with their own accounts at the Windows logon screen they get an error message.

 

 

Yes, if you have laptops that are being set aside exclusively for use in exams, in a GPO targeted at those computers, add your student security group(s) as needed to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> Deny log on locally.

 

If that doesn't quite suit, then you could possibly look at using that same GPO option but with a new security group, and a scheduled task to script the adding and removing of users to and from that new group. If a user is in the group, they're prevented from signing in to the computers under the scope of the GPO, but if they're not in that group, they can use the computer as normal. That will allow those students to still be able to use their accounts on computers elsewhere if you happen to mess up the timing.

 

As for disabling all of the various proofing tools in MS Office apps, that can be done entirely by using GPOs targeted as users. The GPO options needed are sprayed all of ther the place a bit though - there isn't one master switch, so to speak. I did have a list somewhere that we used for Office 2016, but I can't find it now. We've been using ExamWritePad successfully for a few years, so haven't needed the Office lockdown policy. Definitely one to investigate for the future.

 

The school doesn't have that many laptops to begin with, so are loathe to the idea that they will lose a few for the exam period.

 

Most the laptops in use by and getting prepped for the exam periods are bought and used using Learning support money, I believe.

 

Do wish I come across the examwritepad 2 weeks earlier!

Edited May 6, 2022 by StAwash

[mikes]

We just had an inspector from the exam board show up, he was very unhappy with our physical storage and other things that aren't my problem, but with regards to the laptops he only asked 1 question / had 1 problem - he said the pupils using the laptops were sat too close to other students, meaning the noise of them typing will be distracting. That was something I hadn't even considered. He didn't ask any questions about the laptops config (locked down exam accounts via GPO, exam saved locally + network disabled)

[StAwash]

We just had an inspector from the exam board show up, he was very unhappy with our physical storage and other things that aren't my problem, but with regards to the laptops he only asked 1 question / had 1 problem - he said the pupils using the laptops were sat too close to other students, meaning the noise of them typing will be distracting. That was something I hadn't even considered. He didn't ask any questions about the laptops config (locked down exam accounts via GPO, exam saved locally + network disabled)

Thanks for that! I hadn't even considered that as a problem, but after exam periods are over I will bring it up with the exam officers. So far I know they have been segregated from the usual exam pool, do not know the reason but it could be due to this.