Controlled Assessment : How we did it

[gill]

Hope this helps if you're struggling to work out how to do this.

 

Controlled Assessment

 

Different exam boards have different requirements for each subject but in general students need the following:

1. Secure area to store coursework which is only accessible during the supervised session.

2. No access to shared areas or their existing network folder.

 

Depending on the subject they may also need the following locked down or accessible:

1. Internet access

2. Ability to use a USB pen drive

3. Spell check

 

How I did this

 

In active directory I created:

 

1. A security group called Controlled Assessment and any student taking any controlled assessment was added to this group.

2. A security group called Controlled Assessment subject 200* (we added the year group as we have more than one year group taking part in controlled assessments)

3. An OU called Controlled Assessment

4. Within the Controlled assessment OU create OUs for each subject called Controlled Subject 200*

 

I created the following GPOs.

 

1. A GPO for OU Controlled Assessment which applied to every student locking down the usual things like run command etc (you probably already have a GPO which does this)

2. A GPO to lock down internet access

3. A GPO to allow internet access and set browser settings

4. A GPO to lock down access to shared areas

 

You can create as many GPOs as you need. I found it easier to create separate GPOs which I can reuse every year.

 

Link the appropriate policy to the OU Controlled subject 200*

e.g. Geography needs internet access but English doesn’t.

 

Secure Storage

 

I then created a course work shared area on X drive which was subdivided into year groups and controlled assessment subject groups.

 

You’ll need to create a log on script so that students in the security groups you created and teachers can see X drive when they log on.

 

User Accounts

 

I created student user accounts, one per student per subject e.g. 06SmithAEnglish, and 06SmithAHistory etc

Ensure they are members of OU Controlled Assessment and OU Controlled subject 200*. Add them to any other OUs which you may have set up on your network e.g. “All students” or “domain users” etc

 

I gave them roaming profiles.

 

I created a home folder for each student on X drive and used folder redirection to ensure their “My Documents” folder was set up in the right place.

 

e.g. \\servername\course work$\2006\English Controlled Assessment

 

I wanted teaching staff to have access to these folders so I un-ticked “grant the user exclusive rights to My Documents”

 

Folder Permissions

 

Set the folder permissions so that only those students (and teachers) taking English in Year group 2006 have access to the 2006\English Controlled Assessment folder on X drive

 

Set permissions on individual student folders so that only the student and teacher have access to the folder.

 

I then had to log on as each student save a test document and then log off. This created their “My Documents” folder. Set the permissions on this folder so that students and teachers have access. Then log back in and you should now be able to see the test document you created. The teacher should also be able to see the document created in the student’s folder on X drive.

 

Getting the permissions right is critical so test them to make sure they are secure.

 

Controlling access to the folders

 

The easiest way of doing this is to enable all the accounts in AD at the start of the supervised session and disable them again at the end.

 

You can also use the log on hours feature in AD but it only controls logging on it doesn’t force users to log off.

 

Spell Check

 

Don’t waste time trying to block spell check; we couldn’t make it work properly. Every time a user pressed F7 spell check worked! Students who are not permitted to use spell check should use WordPad to complete the assessment.

 

Blocking Apps and pen drives

 

I use Net Support software to allow or block individual apps like WordPad and to block USB pen drives.

 

The software can also be used to block access to the internet.

[SpuffMonkey]

Like it all apart from having to create an account for every student/subject - good grief!

[gill]

That was a bit of a pain but I will try to come up with a way of doing it in a batch file. Fortunately some of our groups were quite small (20 students) but it would be a nightmare if you had 100s of kids!

 

I'm sure there are lots of techies out there far cleverer than me who will find a better way of doing this but in the absence of any technical guidance from the exam boards I thought others might like to see how we tackled the problem.

[Ully]

I agree that putting in all these extra accounts seems like a nightmare. I personally would rather send them all into a room with pen and paper!

[TheCrust]

We did something along the same lines for our CA students as Gill.

 

I created a "GRPExamCandidates" group, and created a copy of the main student GPO called "Exam Candidates GPO".

 

The Exam Candidates GPO redirects student documents folders to another home drive, gives them a different desktop wallpaper (with a "You are under exam conditions!" message in it, as if they didn't need reminding), and a different redirected desktop so access to only the applications we wanted them to have.

 

Deny permissions were set on both the normal student GPO and the Exam Candidates GPO in such a way that when the student was a member of the usual student groups, the normal GPO applied, but when they were a member of GRPExamCandidates, the exams GPO applied and they were denied access to the normal GPO.

 

To control this easily and with minimal administrative input, we have a forms-based automation application called UMRA (from Identity und Access management Lsungen, User Management, Password Management, SSO, RBAC, audit, compliance, licenced per-user account in AD) and I wrote a simple application in that that allowed a nominated user - such as the exams officer, or invigilator -to add the students to the exam group, and take them out again afterwards, but you could do it just as easily yourself with AD Users and Computers.

 

This effectively met all the exam board requirements as far as we could tell - apart from the "students must have individual logons". I don't know quite what they are smoking at the exam boards when they came up with that little gem, but having an individual account for each student for each subject very quickly becomes an administrative nightmare for our network as we run a swipe-card based printing system and each account would need its own print card, not to mention the sheer number of students involved....

 

We argued that the account itself was actually immaterial as long as the secure area / applications use requirements were met, and by allowing the student to use their normal account (but with these modified settings) it maintained consistency from the perspective of logging on and printing.

 

As a precaution against students cheating by passing their user details to someone else in school who could log on concurrently, we reset their passwords as they are sitting down to get the CA underway.

 

Seems to work very well for us.

Edited July 14, 2010 by TheCrust

[alan-d]

We went for the simple solution.

 

Created accounts such as Exam1, Exam2 etc each locked down as appropriate for the assessment. All accounts can only save to a USB. All students log into the one account (e.g. Exam 1), save to a USB and the teachers collect the USBs in at the end.

[john_robinson001]

We did this a very similar way to you gill, with a couple of slight differences.

 

Rather than create separate user accounts for each student taking an assessment, we remapped their user accounts to use a different home-folder path. This way, when we're informed that students need to take a controlled assessment, we just change their home folder path to e.g. \\server\controlledassessment$\english. This automatically creates a folder with the right security permissions etc. When they've finished, we put the home folder back to normal.

[Hecate]

We did more or less the same but created a series of exam accounts for each subject - geogexam-01 etc - the staff in charge of the exam allocated the accounts to the pupils and we delegated them (the staff) permission to enable/disable the accounts. This meant that we didn't have to be involved in scheduling sessions. Once we had shown them how to do it the staff were really happy with it.

[jsnetman]

We don't create extra accounts, we just change the path to their home folder move them to an OU setup to heavily restrict the desktop and apps. Only word can be executed as thats all that is required. A shared area also for research docs. When switched back to their original path and OU they don't have access to the home path for the controlled exam.

[bjohnny42]

Howto: Delegate the enable/disable accounts permission in Active Directory « the back room tech

 

Found the above website to help with enabling the correct permissions for delegation. ***** These users would get a few extra permissions too relating to the account tab and account tab for the user which is worth noting.

[timbo343]

We are going through the controlled assessments at the moment, its a right pain. The way we have done it is to create each user taking a control test with another user for that subject. So in my AD i have the year which they joined... which is their normal account but in a heavily locked down area in AD we have controlled test > {name of subject} > {Groupname}. In here is the users. So we are told when each control test is going ahead i have a number of MMCs open with selected users so i can disable groups of users from the normal account area.

 

Like i said, its a right pain in the backside and wish these exam boards would think about the implications before setting these rules.... wish there was an easier way.

[apeo]

Has anyone figured out how to block Downloading and Uploading to internet?

 

Here all the ad config is done by the teacher i.e. i created a hta for them so they can easily select what they want, and the hta configures the ad users.

[jonnykewell1]

Hi thanks for the info, this is exactly the same as what we are doing, but our lessons start at say 9.50 and finnish at 10.50 for example, where as AD only allows it to the nearest hour. We also tend to forget to open the accounts if we are busy around the school, is there any software we can use to add more specific time and account control?

 

Thanks in Advance.

[gill]

we're finding the same problem, being tied to the office to enable/disable accounts or trying to remember to get back to the office to set things up at the start of a session and most days we have at least one session taking place.

 

I haven't found any software which can do this, does anyone else know of any?

[SpuffMonkey]

AB Tutor?

[jonnykewell1]

we have AB tutor but can you set specific times to which the AD accounts unlock?

[norweg]

In our case – as all classrooms computers are Macs – we:

1. Exported each subject – pupil group to “csv” file (including information about division – set)

2. Imported file to application called “Passenger” – which allows to convert csv file (and add additional information) to format you can import to WGM on OSX server

3. Earlier we prepared groups for each subject as quite subject teachers requested access to specific applications

4. For each group we prepared different default settings (ex. Disabling spell checker, changing look of dock etc.)

5. Every teacher reports at the beginning and the end of session to allow us unlock/lock group account.

[jsnetman]

Great, first assessment last Monday, had it all set up, eaxm OU setup ready to move the pupils in to lock them down and redirect mydocs to another location. Forgot to move them in for the controlled session a bit of a blunder on my part, but I suppose thats the weakness of this type of setup.

[Oxcidius]

We use something very similar to Alan-d. All of our students have their own laptops with their own screen readers etc. so we must let them use their own laptops.

We have a mandatory profile called exam which every student uses and logs in with.

Everything is locked down on it including internet, applications except Notepad, Wordpad and Word (we kill spelling & Grammar on this app) and the screen readers and access to any drives except the use of pen drives.

The pen drives themsleves are heavily guarded by our exam officers and wiped every time they are used.

We change the desktop wallpaper so they know they are in exams.

We use a .vbs script to add the app links to the desktop so that we can lock down as much as possible in the start menu etc.

So far, this has worked exceedingly well as the exam officers have their own laptop hooked up to a printer in the exam room and when the student is finished they hand over the pen drive, exam officer prints it out and after confirming all is there, lets the student go.

This way from our point of view we only have to worry about one AD account and we are not tied to any scheduling. in fact I think for the last set of exams I didn't have to lift a finger....cool!!

[jonnykewell1]

good idea, but we have recently banned memory sticks :'(

[browolf]

this has just turned up at our place. afaik atm it's looking like 150 students across geography, ICT and business studies.

We've done this before for engineering and photography but it wasn't remotely that many students. 20 temp accounts as a one off is no prob. 150 across different subjects, different classes is a nightmare....

 

My thinking atm is to create a single account for each class with normal locked down security but doesn't attach any of the usual drives and blocks internet access, when a student logs in it creates a folder with a random 10 or longer character/number string and asks for a password. on subsequent logins it'll ask for the folder name and a password and map a drive to that folder. I theorise this can be handled with vbscript.

we can enable and disable the accounts as required. probably have to ask for their username too as if a kid looses his folder details we wouldn't know which was which lol.

 

this might seem a bit crazy complicated but we need a relatively foolproof method that has minimal management time and can easily be utilised in the future, if this controlled assessment thing becomes the norm it could end 00s of potential accounts given we have 200-300 kids per year.

[Steven_Cleaver]

Logon on hours on user accounts got the staff to send me times the students would be sitting the controlled Assessment so that I could preset the hours for the accounts.

[imiddleton25]

log on hours is proving a big problem here

as they want 1.45 till 3 for one lot and AD cant do the time limit as it works in whole hours so have to be there to unlock and lock accounts again.

On the plus side we have written a small program to export existing users OU append with given subjects and import into a new OU . so 01black get 01black-geog , 01black-engl ......... .Its saving us some time and still developing it to do more. but we have 2 subjects using controlled assesmets with no problems. so hopefully we are now on top of this and ready for more subjects to do it.

[timbo343]

Sounds like some of you have it easy at the mo.. We now have 4 subjects doing control tests... Geog, business, history and english. English have 120 students to enable and disable, shortly followed by geog, history and business. I dunno if i mentioned it before, but we have set up a temp machine in the office with lots of AD MMC snap-ins with the users highlighted from each group (as we have OUs with the year the students started) and labelled them up on the bottom of the monitor. This machine doesnt get turned off and remains locked if not inuse.

[kili]

Hi guys I try to keep it simple. The following may not look simple to set-up but once done its schedule task and forget until the next year group need setting up the following year.

 

Here’s what I do step by step.

 

1. Create and run a batch file using the mkdir or md commands to make a controlled conditions folder in the home folder of all the users who need exam conditions e.g. “controlled exams”

This batch file will be used only once so if you don’t want to bother with the batch file just copy and paste from your excel sheet straight to the command prompt on your server ( Make sure your in the correct ou/folder)

 

2. Create two batch files one to DENY access to “controlled exams” and one to GRANT access using the cacls command e.g

 

Teachers_initals_deny.bat

Deny access should contain cacls commands to set the users permissions on his/her home folder and all sub folders and files to read and list only so that on login they can access their home folder but cant create folders or save files, then set the “controlled exams” folder only to modify, read, write or full control ( if you trust them not to delete the folder)

 

The reason for this set-up is to stop them copying the work created in “controlled exams” to any other folder in their home folder so they can edit the work later at their leisure.

 

Teachers_initals_grant.bat

The batch file will obviously reset full control over the users home folder, sub folders and files back to the user with the exception of “controlled exams” which will have the deny permission set at the end of the lesson

 

Schedule these batch files to run on your server 5 minutes before the start of a lesson and 5 minutes after the lesson.

 

3. We have an AD group called “Deny internet Access” any account placed in this group is as the name suggests denied Internet access .for you to achieve the same will depend on what Internet filtering system you are using – we use Lightspeed which integrates with AD.

As long as you have a deny internet ou integrated with AD with your given Internet filtering software your good to go. Again the need is to deny students access in this case to the Internet under exam conditions to do this we use two commands run from batch files scheduled to run right after the batch files above.

 

e.g addgrp.bat

dsmod group with the –addmbr switch

This command is used to add the students to the “Deny Internet Access” ou

 

e.g remgrp.bat

dsmod group with the -rmmbr switch

This command is used to remove the students from the “Deny Internet Access” ou

 

To summarise :

 

• logged on under exam conditions all access to users folders and files in the students home folder except the “controlled exam” folder is blocked.

 

•When not logged on under exam conditions users files and folders except “controlled exam” are accessible

 

• When logged on under exam conditions denies access to the internet

 

• When not logged on under exam conditions grants access to the internet

 

• No need to create separate AD login accounts or additional folders

 

The only pitfalls as far as I can is if the teacher changes the lesson time without informing us. And students are allowed to plug in USB sticks during lessons to copy the exam work

 

Hopefully this will help someone – works for us if you want batch file examples post here and I'll post the code

 

Kili

Edited October 11, 2010 by kili