My Recommendations: Exam Laptops No Internet Access

[MatTheTech]

A common requirement for exams and exam laptops is for the laptop to have no internet access for the duration of an exam. I've seen people try to achieve this in various ways and to be honest quite complicated un-necessary ways such as in group policy with software restriction policies which aren't always reliable.

 

If you require exam laptops with no internet. I would recommend:

 

- Imaging them from the beginning with the bare minimum.

- Ensure there is AV installed for security reasons

- create a wireless VLAN which exam laptops only use. On this VLAN either have an ACL that allows access to get a DHCP address and local network access (for purposes if required such as local access to print for example). I will post a Cisco ACL shortly as an example or have a firewall rule which blocks internet access for that subnet/VLAN. The key is though that the devices are on a separate VLAN isolated separately so you can impose certain restrictions.

- Have an "Exam Laptops" OU in AD in which you can create a GPO to block all networks apart from the one SSID that you join the laptop too to put it on the VLAN/Subnet with blocked internet.

 

Hope this helps!

[Davit2005]

13 hours ago, MatTheTech said:

- Have an "Exam Laptops" OU in AD in which you can create a GPO to block all networks apart from the one SSID that you join the laptop too to put it on the VLAN/Subnet with blocked internet.

One Alternative possibly 🙂

Create reservations on DHCP server for the laptops, block those IPs at firewall level. No GPO to worry about checking/testing, no extra SSID to create. Easy on off, providing you manage your own firewall.

 

One hiccup is for exams that do need Internet exams be that for Moodle or external exam boards. The rules could be limited to those services via the firewall above rule that blocks access, assuming firewall works from top to bottom.

 

 

Edited February 24 by Davit2005

[simpsonj]

I've found that setting a Computer based Firewall rule GPO that blocks all outbound traffic seems to do the job. Particularly useful as both Edge and Chrome seem desperate to create a desktop shortcut for you for their respective browsers 😡

[MatTheTech]

I'm in favour of settings above the client as such as its more of a blanket and simplified, clean cut approach.. definitely better than faffing around with software restriction polices. i think blocking the wifi to only one network/ssid is a good thing in GPO as it means the device can only join the block internet wifi which rules out room for error or cheating the system.

[synaesthesia]

Still too much involved  

Standard device - meaning you can use ANY device.

 

Impero/Netsupport/ABTutor/Insert any classroom management tool here.

ExamWritePad. (Or online equivelent and add that to the whitelist).

 

[BKGarry]

I have a set of 32 laptops with Windows installed, just exam write pad and Adobe Reader and all the wireless cards removed. Can't get more secure than that 🙂

[sraper]

I had just raised a similar query earlier. 

Tempted for the no internet to just disable the wireless drivers so no network at all!

 

However what I am struggling to work out is that I have been told that they MUST use MS Word but not be able to switch to another app.   Is there any "simple" way to force "single-app" mode to Word.

Using options like Kiosk Mode or Exam mode  seem to go down the route of opening a browser at a fixed URL - or maybe opening a Store app. However I want to run only Winword.exe nothing more than that

[Jawloms]

We just set the exam accounts to have a proxy server that is garbage.

[Driftingashore]

We go about this in a different fairly complex way - just posting a vague outline for info / any critique. We're high functioning SEN, so distractions (ability to poke around, open anything other than ExamWritePad) need to be minimal. This is admin-heavy but it's all to keep things on the safe side. 

 

Our exam laptops are created from a stripped down Windows 11 image, domain joined, and placed into an Exam OU.

Exam Users are bulk created by a script, then a second script bulk resets their passwords to six digits and creates a .csv . The CSV is printed, and the username / password stuck to the palm rest of the laptop. A note is made of which laptop is given which user, and then post-exam, which user used which account/laptop, for which exam ('covering an inevitable x forgot to print!' a day later but not knowing what laptop they used). After usage, the exam document is copied from the user's local profile to the user's mapped network drive, and that Exam User is disabled in AD. 

 

There aren't many policies applied to Exam PCs:

Login group restrictions to prevent anyone other than IT/senior staff and Exam Users logging into them. 

AppLocker rules to deny Exam Users the ability to run Edge / Chrome / Teams / Office (most shouldn't be on there, but Teams finds a way and I'd like to cover my ass if someone demands a laptop with near zero notice)

Policies that kill Windows Search

Apply the desired printers

Random Intune policy to disable Bluetooth (seems to be the only reliable way to do it and isn't available in a GPO)

 

Policies applied to Exam Users:

Fake proxy settings to kill the internet

Lock down the settings app / control panel

Pin ExamWritePad to the Start Menu (also a shortcut added to the user's desktop during creation as a backup)

 

TLDR; What we've ended up with is a PC that can access the internet, but only when logged off, or logged in as IT or senior staff, meaning updates are easy and we can manage it via Intune, but the Exam user can't see or open anything but ExamWritePad and a locked down Settings app.. they couldn't access the internet via any network, or open any installed browser if they tried, and it's not like students have time on their side. 

 

Again the above is a vague description; the admin / logging is irritating, but can't trust teachers not to ask for a copy of a student's mock paper four months later, or for a student to log out then need to know the login details again etc. 

[synaesthesia]

Should hasten to add - we have dedicated users for the exam accounts which mean they can't do anything other than use examwritepad and print. Simple, foolproof, doesn't get abused and little to no management overhead.

[altecsole]

1 hour ago, Jawloms said:

We just set the exam accounts to have a proxy server that is garbage.

Same. 

[jthompson]

Dedicated exam user accounts, so that everything (AppLocker rules and web proxy configuration) is taken care of by Group Policy.

 

Software deployments taken care of by Group Policy computer configurations.

 

Any computers can then be employed for exam conditions without affecting their use in lessons either side.

 

Exam-specific OS deployment seems overly complicated to me, unless I'm missing something?

[simpsonj]

20 hours ago, BKGarry said:

I have a set of 32 laptops with Windows installed, just exam write pad and Adobe Reader and all the wireless cards removed. Can't get more secure than that 🙂

How do they print?

[drutt]

16 hours ago, jthompson said:

Exam-specific OS deployment seems overly complicated to me, unless I'm missing something?

 

An anal exams officer who likes to take the requirements to the extreme

[BKGarry]

They don't, the Exams Officer and SEN Admin people take copies of the ExamWritePad files and print them in the Exams Office

[Driftingashore]

16 hours ago, jthompson said:

Exam-specific OS deployment seems overly complicated to me, unless I'm missing something?

 

I just do it (1) to ensure standardised behaviour and ease of testing, (2) it's easy to justify the approach that a laptop for meaningful exams shouldn't have anything more than what is needed to complete the exam installed on it, and (3) the install / OS / device wasn't available to students to tamper beforehand.

 

I suppose there's also a fourth reason: our exam cohort get new laptops purchased to complete the exams on. Once the exams are over, those laptops will get redistributed as part of the device refresh strategy (again, this offers standardisation and gives each student the same tools and avoids questions about unfairness, and eases the setup i.e. all using the same chargers, ensures the battery will outlast any power cut etc).

 

If I'm going to image new laptops anyway to remove any OEM junk, I may as well. Again, we're SEN so the numbers just happen to work in this regard. At the end of the day I want to give the student the best chance of success, and I'd rather play it on the safe side, though I'm aware that I may be overthinking things, and am probably on the extreme end of the spectrum.. but eh.. I'd much rather defend the position that I'm going overboard than otherwise.