School Controlled Assessments

[Simes1982]

Hi. I am an IT technician in a school that wants to carry out controlled assessments. All staff and students store their work on OneDrive. We use active directory for accounts. We want to find a way to limit the student access to their assessments as they cannot work on them outside a set amount of hours. The work also needs to be easily accessed by the teacher. Are there any IT professionals out there that are working in schools that have had to do something similar? What was your solution?

Thank you

[tg12]

Not the easiest method but we use folders in SharePoint, where the permissions are locked down and they are only given access at the start of each session and permissions are removed again at the end.

[jthompson]

We just provision numbered exam accounts (e.g. exam0000, exam0001, etc.), and limit the availability of those the just the CA sessions. A list of student names and exam account credentials is shared with staff as required. They generally do some kind of merge or printout so that each student is provided with their assigned exam account credentials somehow. Unique, generated passwords for each account, with the accounts set to not allow the user to change the password. The accounts get disabled after the end of a session.

[howartp]

Powershell script to deploy exam files into exam/CA accounts, enable/disable them on schedule, and backup to central store that exam team can access to print and/or upload to online submission.

[dhandford]

We have exam accounts similar to others where we have them inactive until the session requires them, teachers manage which student uses which account and we just administer the accounts themselves, taking a backup after the exam and putting that in a secure area for exams staff to access. We then clear and reset the accounts using AD Manager. We have headaches with them though and I would like a better solution if anyone can suggest something else they do as the logistics of it all can get a bit overwhelming.

[Mako]

Here they have dedicated CA accounts. We used to have it like some of the above where the account is disabled until required, however that caused issues as we use O365 now and disabling the account will also cause issues with O365 licensing as the account is disabled in the cloud too. The delay in ADSync recognising the account was re-enabled made it untenable.

 

Instead, the accounts are logged in directly by IT staff or the Exams Officer, who knows the password(s) for the accounts. The account cannot change its own password so the students can't usurp control from us or go and log in elsewhere.

[jthompson]

Yes, can recommend preventing users from changing the passwords. You might need to set the passwords to never expire, depending on passwords policies in your environment.

 

If staff are signing the accounts in ahead of the session, it might be worth applying a GPO to the relevant computers that sets a suitably long sleep timeout (i.e. several hours), so that staff aren't needing to unlock machines for people.