Controlled Assessment : How we did it

[themightymrp]

Here's an idea for the enabling and disabling of accounts to get around the Microsoft restriction of logon hours being only based on nearest hour.

 

If you have accounts specifically set up such as exam01, exam02 etc then you can do the following:

 

Create 2 batch files called 'enable exams.bat' and 'disable exams.bat'. Use the following commands

 

net user exam01 /active:yes /domain

net user exam02 /active:yes /domain

etc...

 

AND

 

net user exam01 /active:no /domain

net user exam02 /active:no /domain

etc....

 

Copy these files to a domain controller and then use the Windows Task Scheduler to run the enable/disable script at the exact times and dates you want

[timbo343]

Here's an idea for the enabling and disabling of accounts to get around the Microsoft restriction of logon hours being only based on nearest hour.

 

If you have accounts specifically set up such as exam01, exam02 etc then you can do the following:

 

Create 2 batch files called 'enable exams.bat' and 'disable exams.bat'. Use the following commands

 

net user exam01 /active:yes /domain

net user exam02 /active:yes /domain

etc...

 

AND

 

net user exam01 /active:no /domain

net user exam02 /active:no /domain

etc....

 

Copy these files to a domain controller and then use the Windows Task Scheduler to run the enable/disable script at the exact times and dates you want

 

Ahhh not bad... but what about for all the kids that we have to disable too when the exam accounts are enabled.

 

Would we have to add all the students in or would it be possible to do the following:

 

Enable Exam accounts/Disable Main Account:

net user exam01 /active:yes /domain

net user useraccount /active:no /domain

 

net user exam 02 /active:yes /domain

net user useraccount /active:no /domain

 

etc....

 

Disable Exam Accounts/Enable Main Account:

net user exam01 /active:no /domain

net user useraccount /active:yes /domain

 

net user exam 02 /active:no /domain

net user useraccount /active:yes /domain

 

etc....

[JezR]

As an improvement on the above I have a vb script that reads a list of users from a text file and moves them from their normal OU to a controlled assessment OU, and adds them to the controlled assessment security group.

 

This is run as a sheduled task on a domain controller.

 

At the end of the controlled assessment another scheduled script reverses the process.

 

Works a treat.

 

Jez

[timbo343]

Here's an idea for the enabling and disabling of accounts to get around the Microsoft restriction of logon hours being only based on nearest hour.

 

If you have accounts specifically set up such as exam01, exam02 etc then you can do the following:

 

Create 2 batch files called 'enable exams.bat' and 'disable exams.bat'. Use the following commands

 

net user exam01 /active:yes /domain

net user exam02 /active:yes /domain

etc...

 

AND

 

net user exam01 /active:no /domain

net user exam02 /active:no /domain

etc....

 

Copy these files to a domain controller and then use the Windows Task Scheduler to run the enable/disable script at the exact times and dates you want

 

Works an absolute treat! Thank You very much. Set up was a bit of a nightmare for existing control accounts but from now on, this creation will be part of the setup of control tests.

[tmcd35]

We're going through Controlled Assessments at the moment. I've decided to run it like this -

 

Teacher requests controlled assessment accounts, provides day's/time's accounts need to be active.

 

We create enough user accounts for that request based on the teachers initials - eg. SCO1...SCO30. We use WiseSofts Bulk User Account spreadsheet to create these account in the right OU in seconds - job done.

 

Teacher assigns an account to each student.

 

Shift click on the the accounts in OU to highlight, right click and enable at the start of the lessons. Shift-A and disable at the end of the lessons.

 

We've set up a 'Block Internet' policy in AbTutor that turns off internet in that ICT suite only and is set to 1 hour or when the student logs off so that the next class have their internet access back.

 

Couldn't be quicker, easier or any less hassle.

[themightymrp]

Thanks Jonny and Timbo, glad this has helped

[browolf]

How I've done it, and if I do say so myself it's pure genius.

 

summary

=======

a single user account runs a vb script that will map unique userareas based on a 10char code entered.

 

 

1. a single standard pupil account with no user area, own login script

2. hidden shared folder that account has full control off in permissions and share

3. login script:

 

'on error resume next


Dim fso, msg
Set fso = CreateObject("Scripting.FileSystemObject")
Set objNetwork = CreateObject("WScript.Network") 
Set objShell = WScript.CreateObject("WScript.Shell")

Do until completed=true 

foldername = ""

Do until foldername>""

foldername=inputbox ("Enter Code", "Controlled Assessments")


loop
  
  
fldr = "\\server\share\" & foldername

If (fso.FolderExists("s:\")) Then objNetwork.RemoveNetworkDrive "s:"



  If (fso.FolderExists(fldr)) Then 
	objNetwork.MapNetworkDrive "s:", "\\server\share\"&foldername
  
  If (fso.FolderExists("s:\")) Then 
	ret=msgbox("Connected", 64)
               completed=true
  else 
	ret=msgbox("userarea failed", 48) 
               completed=false
     end if
  
  Elseif (fso.FolderExists(fldr) <> true) then
     ret=msgbox("Code not found!",48)
     completed=false
  End If


loop

 

4. script to create the folders

 

function createcode 
stringlist="abcdefghijkmnpqrstuvwxyz"
count=0
code=""

do while count < 10 

	upperbound=len(stringlist)
	lowerbound=0

	pick=Int((upperbound - lowerbound + 1) * Rnd + lowerbound)
	if pick=0 then pick=1 end if
	'wscript.echo pick
	getletter=Mid(stringlist,pick,1)
	code=code & getletter

	count=count+1
loop
createcode=code

end function

'==================================================
'START

Const ForReading = 1, ForWriting = 2
Dim fso, f
  Set fso = CreateObject("Scripting.FileSystemObject")

Set objArgs = WScript.Arguments

bob=0

if objargs.count < 1 then 

wscript.echo "Specify how many accounts you want"
wscript.quit

end if

filename="c:\codelist" & int(objargs(0)) & ".txt"
Set f = fso.OpenTextFile(filename, ForWriting, True)

randomize
do until bob = int(objargs(0))
codename=createcode

f.writeline codename
wscript.echo codename
bob=bob+1
'wscript.echo bob


folderpath = "\\server\share\" & codename
'wscript.echo folderpath
Set g = fso.CreateFolder(folderpath)



loop

f.close

 

5. things to take care of

---skip normal login script (stop resource drives being connected)

---prevent internet access

 

6. teachers responsibility to allocate and keep records of which kid uses which code

 

7. technicians responsibly to change the login password before and after each session & run the script to create the codes.

 

 

========================

[kili]

How I've done it, and if I do say so myself it's pure genius.

 

summary

=======

a single user account runs a vb script that will map unique userareas based on a 10char code entered.

 

 

1. a single standard pupil account with no user area, own login script

2. hidden shared folder that account has full control off in permissions and share

3. login script:

 

'on error resume next


Dim fso, msg
Set fso = CreateObject("Scripting.FileSystemObject")
Set objNetwork = CreateObject("WScript.Network") 
Set objShell = WScript.CreateObject("WScript.Shell")

Do until completed=true 

foldername = ""

Do until foldername>""

foldername=inputbox ("Enter Code", "Controlled Assessments")


loop
  
  
fldr = "\\server\share\" & foldername

If (fso.FolderExists("s:\")) Then objNetwork.RemoveNetworkDrive "s:"



  If (fso.FolderExists(fldr)) Then 
	objNetwork.MapNetworkDrive "s:", "\\server\share\"&foldername
  
  If (fso.FolderExists("s:\")) Then 
	ret=msgbox("Connected", 64)
               completed=true
  else 
	ret=msgbox("userarea failed", 48) 
               completed=false
     end if
  
  Elseif (fso.FolderExists(fldr) <> true) then
     ret=msgbox("Code not found!",48)
     completed=false
  End If


loop

 

4. script to create the folders

 

function createcode 
stringlist="abcdefghijkmnpqrstuvwxyz"
count=0
code=""

do while count < 10 

	upperbound=len(stringlist)
	lowerbound=0

	pick=Int((upperbound - lowerbound + 1) * Rnd + lowerbound)
	if pick=0 then pick=1 end if
	'wscript.echo pick
	getletter=Mid(stringlist,pick,1)
	code=code & getletter

	count=count+1
loop
createcode=code

end function

'==================================================
'START

Const ForReading = 1, ForWriting = 2
Dim fso, f
  Set fso = CreateObject("Scripting.FileSystemObject")

Set objArgs = WScript.Arguments

bob=0

if objargs.count < 1 then 

wscript.echo "Specify how many accounts you want"
wscript.quit

end if

filename="c:\codelist" & int(objargs(0)) & ".txt"
Set f = fso.OpenTextFile(filename, ForWriting, True)

randomize
do until bob = int(objargs(0))
codename=createcode

f.writeline codename
wscript.echo codename
bob=bob+1
'wscript.echo bob


folderpath = "\\server\share\" & codename
'wscript.echo folderpath
Set g = fso.CreateFolder(folderpath)



loop

f.close

 

5. things to take care of

---skip normal login script (stop resource drives being connected)

---prevent internet access

 

6. teachers responsibility to allocate and keep records of which kid uses which code

 

7. technicians responsibly to change the login password before and after each session & run the script to create the codes.

 

 

========================

 

Congratulations on the code which may or may not be pure genius as I'm not a coder I couldn't say.

However as I understand it this requires the creation of another account per student distinct from their existing user account , is that the case?

[browolf]

Congratulations on the code which may or may not be pure genius as I'm not a coder I couldn't say.

However as I understand it this requires the creation of another account per student distinct from their existing user account , is that the case?

 

yes, pretty much.

[kili]

yes, pretty much.

 

Thats a shame useful code but a duplication of accounts is just creating more work, good effort though I wish my coding skills were up to your standard.

 

Kili

[apeo]

We have a different account for users to use for Controlled Assessments here too but we only have 1 which is used for all departments. Well thats the way its been configured/planned but currently only 1 department uses it.

 

BTW do ppl still want a way to set when accounts are available for a specific time period. I've only skimmed so i may have missed it (if i have sorry) but the way we do it here is that the teacher at the start of the lesson sets the account expire date using the hta i developed. It uses the following code to set when accounts will expire and this can define exact time and date:

 

Set objUser = GetObject("LDAP://cn=Name,ou=OU,dc=Domain,dc=com")
objUser.AccountExpirationDate = #15/10/2010 10:28#
objUser.SetInfo 

[test_richie]

Here's an idea for the enabling and disabling of accounts to get around the Microsoft restriction of logon hours being only based on nearest hour.

 

If you have accounts specifically set up such as exam01, exam02 etc then you can do the following:

 

Create 2 batch files called 'enable exams.bat' and 'disable exams.bat'. Use the following commands

 

net user exam01 /active:yes /domain

net user exam02 /active:yes /domain

etc...

 

AND

 

net user exam01 /active:no /domain

net user exam02 /active:no /domain

etc....

 

Copy these files to a domain controller and then use the Windows Task Scheduler to run the enable/disable script at the exact times and dates you want

 

Have just started to use this here. Works great. Thanks

[kili]

Have just started to use this here. Works great. Thanks

 

 

Yes but it still requires two accounts per student which just creates additional work. Access to a controlled exam folder placed in the users existing home folder makes much more sense and there's no need for additional accounts for each student

[tmcd35]

Yes but it still requires two accounts per student which just creates additional work. Access to a controlled exam folder placed in the users existing home folder makes much more sense and there's no need for additional accounts for each student

 

Does that not break the conditions of the controlled exam? you need to manage availability of that folder outside of the controlled assessments and the user would have access to the rest of their user documents during the controlled assessments?

[Disease]

We had controlled assessment the other day for English. However my exams officer did not as me to set anything up at all?

[kili]

Does that not break the conditions of the controlled exam? you need to manage availability of that folder outside of the controlled assessments and the user would have access to the rest of their user documents during the controlled assessments?

 

 

No it does not. If you read my original post further back in this thread #25 you'll see how to set this up

[apeo]

No it does not. If you read my original post further back in this thread #25 you'll see how to set this up

 

Man this whole thing is just funny, so many clever ways of doing it.

 

@kili: just wondered, do you currently run this solution for multiple departments/subjects? or just the 1.. Also i assume you have a restriction in regards to shared folders e.g. mapped drives, and can i just clarify that they still have access to any documents within their home directory while in 'Controlled Assesment' i.e. they can read document/files that exist there already.

 

Just a thought which may make it easier is to create a new security group in ad and set them to deny permissions to the home directory but grant permission to the controlled assessment folder within the home dir. That way instead of editing the ntfs permissions on folders you just add and remove users from the group, much like how you move them to the OU with the internet restriction.

[Tunster]

Very interesting reading! We've gone through the same processes. However, I don't understand the subjects that require internet access. How can that be controlled? At first, it's easy for the student to upload their work to an e-mail/file storage site, work on it at home and then come back the next lesson to download it. Especially if the teacher isn't so "IT savvy" and doesn't pay attention at the end of lessons. We've questioned this time after time, but our exams officer just says that's the exam boards rules.

 

I'd recommend creating a suffix and then numbering the accounts. This way, you can log the account numbers in a spreadsheet. For example; ICTCAB001. We can then segregate them into different class groups and also put them in correct OUs so you can lock down accounts using the logon hours function. Saves me having to enable and disable them all the time!

[kili]

Man this whole thing is just funny, so many clever ways of doing it.

 

@kili: just wondered, do you currently run this solution for multiple departments/subjects? or just the 1.. Also i assume you have a restriction in regards to shared folders e.g. mapped drives, and can i just clarify that they still have access to any documents within their home directory while in 'Controlled Assesment' i.e. they can read document/files that exist there already.

 

Just a thought which may make it easier is to create a new security group in ad and set them to deny permissions to the home directory but grant permission to the controlled assessment folder within the home dir. That way instead of editing the ntfs permissions on folders you just add and remove users from the group, much like how you move them to the OU with the internet restriction.

 

We run this for two groups at the moment.

 

When in a controlled environment they don't have access to any other folders within their home folder they only have access to the controlled folder , access is denied to all other folders or folders on any other mapped drives for the period of the lesson. When the lesson is over permission is auto scheduled to deny access to the controlled folder and grant them access to their home folder files and mapped drives.

 

Kili

[apeo]

@kili: Figured thats what happens, i do think using group permisisons would be quicker/easier though (instead of setting file permission all the time)

 

@Tunster: Ref access to internet, yeah tell me about it. I've flagged this but they're just ignoring it. Havent yet found a way to block uploads and downloads. With accounts though, are you suggesting a different account for each subject/policy(some subject want certain restrictions sometimes but not others so have more then 1 policy)?

[zag]

What a idiotic idea this controlled assessment is! Talk about moving the donkey work onto ICT staff!

 

We simply use the same normal accounts but disable their my documents and internet for the session.

 

They save their work in a shared folder which I move when the session is complete.

 

Seems to work but not idea solution.

[kili]

@kili: Figured thats what happens, i do think using group permisisons would be quicker/easier though (instead of setting file permission all the time)

 

@Tunster: Ref access to internet, yeah tell me about it. I've flagged this but they're just ignoring it. Havent yet found a way to block uploads and downloads. With accounts though, are you suggesting a different account for each subject/policy(some subject want certain restrictions sometimes but not others so have more then 1 policy)?

 

 

Apeo I only set the permissions once at the start of the year and then forget it. All permissions are assigned using calcs via a batch file which is scheduled to run at certain times of the day.

 

So no work involved set and forget

 

I'm for an easy life:tea::tea:

[kili]

What a idiotic idea this controlled assessment is! Talk about moving the donkey work onto ICT staff!

 

We simply use the same normal accounts but disable their my documents and internet for the session.

 

They save their work in a shared folder which I move when the session is complete.

 

Seems to work but not idea solution.

 

 

You need to automate the process creating batch files which use

 

1. Calcs

cacls "07STUDENTFOLDERNAME\CCEA Control" /e /d 07STUDENTNAME

 

2. dsquery group

dsquery group "OU=School Administration,OU=Administration,dc=YOURDOMAIN,dc=YOURDOMAIN,dc=local" -name "Deny Internet Access" | dsmod group -addmbr "cn=test,ou=2006,ou=Students,ou=Users,ou=School Resources,dc=YOUR DC ,dc=YOURDOMAIN,dc=local"

 

Also dsquery group with the -rmmbr ( As opposed to the -addmbr above)

 

Obviously your ou paths will have a different structure

 

Kili

[apeo]

Apeo I only set the permissions once at the start of the year and then forget it. All permissions are assigned using calcs via a batch file which is scheduled to run at certain times of the day.

 

So no work involved set and forget

 

I'm for an easy life:tea::tea:

 

Yeah i get that, what i meant was the script will be assigning permission on each folder/subfolder/file which will be variable. Instead the script could just add and remove members into a security group, which is probably slightly less processing and potential for error. Is just another way of doing the same thing.

[test_richie]

Yes but it still requires two accounts per student which just creates additional work. Access to a controlled exam folder placed in the users existing home folder makes much more sense and there's no need for additional accounts for each student

 

Indeed it does. But for us this is working the best. And it doesn't take 2mins to make a group of another user accounts from a CSV file.