Controlled Assessment : How we did it

[ctbjs]

We use something very similar to Alan-d. All of our students have their own laptops with their own screen readers etc. so we must let them use their own laptops.

We have a mandatory profile called exam which every student uses and logs in with.

Everything is locked down on it including internet, applications except Notepad, Wordpad and Word (we kill spelling & Grammar on this app) and the screen readers and access to any drives except the use of pen drives.

The pen drives themsleves are heavily guarded by our exam officers and wiped every time they are used.

We change the desktop wallpaper so they know they are in exams.

We use a .vbs script to add the app links to the desktop so that we can lock down as much as possible in the start menu etc.

So far, this has worked exceedingly well as the exam officers have their own laptop hooked up to a printer in the exam room and when the student is finished they hand over the pen drive, exam officer prints it out and after confirming all is there, lets the student go.

This way from our point of view we only have to worry about one AD account and we are not tied to any scheduling. in fact I think for the last set of exams I didn't have to lift a finger....cool!!

 

This is the way we plan on doing it, takes all the worry out of it. The only concern then is the collation of the data as it is stored on memory sticks. All this creation of new accounts and folders for storage seems over the top but hats off to those that have the time for this.

[alan-d]

We use something very similar to Alan-d.

We have now changed the way we do things See APEO posts. Basically our only involvment is to create duplicate accounts using their exam number as a login and set up an OU with the correct GPO to control access to the various options. The teaching staff do the rest by selecting the students names, start and finish times and tell the students to use the exam login. The staff have read only access to the folders.

 

The initial setup may take a bit of effort, apeo can testify to that but the end result means that the staff can pick and choose to enable and disable the controlled assessment accounts as they wish without waiting for us to do it for them. Especially helpful if they have a student that was out of school during the assessment and needs to catch up.

[kili]

Yeah i get that, what i meant was the script will be assigning permission on each folder/subfolder/file which will be variable. Instead the script could just add and remove members into a security group, which is probably slightly less processing and potential for error. Is just another way of doing the same thing.

 

No it's not the same, using a security group will not work. I don't want to assign group access to an individuals folder hence the reason for assigning permissions to the individuals folder and not a group.

[apeo]

No it's not the same, using a security group will not work. I don't want to assign group access to an individuals folder hence the reason for assigning permissions to the individuals folder and not a group.

 

I was more thinking along the lines of assigning the group permissions with deny permission i.e. if you setup 2 security groups and both only has deny permissions so depending on which one you belong to you're denied access to the folder the group is on. The groups dont grant access, it just means that if you're a member you dont have access.

[oxide54]

 

To control this easily and with minimal administrative input, we have a forms-based automation application called UMRA (from Identity und Access management Lsungen, User Management, Password Management, SSO, RBAC, audit, compliance, licenced per-user account in AD) and I wrote a simple application in that that allowed a nominated user - such as the exams officer, or invigilator -to add the students to the exam group, and take them out again afterwards, but you could do it just as easily yourself with AD Users and Computers.

 

.

 

you can knock something up do this in c# / asp.net quite easily

[kili]

I was more thinking along the lines of assigning the group permissions with deny permission i.e. if you setup 2 security groups and both only has deny permissions so depending on which one you belong to you're denied access to the folder the group is on. The groups dont grant access, it just means that if you're a member you dont have access.

 

Yes that may work for groups. Where not assigning access to groups but individuals.

[apeo]

Yes that may work for groups. Where not assigning access to groups but individuals.

 

Yes you keep the user (individual) permissions the same but you add and remove said user to appropriate security group to deny permissios to appropriate folders/files.

[kili]

Yes you keep the user (individual) permissions the same but you add and remove said user to appropriate security group to deny permissios to appropriate folders/files.

 

What your implying is that all users of a security group have access to a common group folder which is not the case for our setup. All users have a folder within their home folder so permissions are set on a single folder, there are no additional security groups needed or required as the destination is their home folder not the creation of additional folders and security groups.

 

Go read my original post

[apeo]

Nope not implying that at all. I'll pm you.

[browolf]

Congratulations on the code which may or may not be pure genius as I'm not a coder I couldn't say.

However as I understand it this requires the creation of another account per student distinct from their existing user account , is that the case?

 

re-reading the thread I realise I made it sound more complicated that it is.

For the record it requires only ONE active directory account to function.

Edited December 3, 2010 by browolf

[dparry]

We have designated exam machines which we can drop into an exam OU for the duration of the exam period. When combined with exam user logins, these machines are pretty well examproof. It also allows us to block spellcheck via group policy.

 

Group Policy

Computer Settings

Security Settings

Software Restriction Policies/Additional Rules

Hash Rules

 

Here you can browse to .exe files or, for spell check blocking, to MSSpell3.dll. I also block calc.exe and mspaint.exe in this way.

[GilRil]

i have made a program for my school which the teachers use to setup and control thier CA, then its up to them if it dont work

they run the program, select the details of the CA, add the users from from Sims click "Create CA" and it creates folders,

Subject, Date, Teachers name, Time in a Fodler on the network (R drive) also assigns a Logon name to the student (we have 100 accounts already setup Exam01, Exam02,,,,) , the folders are locked when created,

the teacher can print this list any time to tell the students what logon name to use

when the teacher is ready to do the CA they open the program, click Unlock which assign the permissions to the folders for that CA, e.g. Subject, Date, Teacher Name, Time, the students then logon with the exam account, and save the work into the R drive (the only they have)

once the CA is over the teacher clicks Lock and the program locks all the folders for that CA, the teachers can access that folder at any time

 

about 3 teachers are using at the moment and it seems ok, some small problems but easy corrected

i have a help file if anyone want to email me

Thanks

[Kingstech]

i have made a program for my school which the teachers use to setup and control thier CA, then its up to them if it dont work

they run the program, select the details of the CA, add the users from from Sims click "Create CA" and it creates folders,

Subject, Date, Teachers name, Time in a Fodler on the network (R drive) also assigns a Logon name to the student (we have 100 accounts already setup Exam01, Exam02,,,,) , the folders are locked when created,

the teacher can print this list any time to tell the students what logon name to use

when the teacher is ready to do the CA they open the program, click Unlock which assign the permissions to the folders for that CA, e.g. Subject, Date, Teacher Name, Time, the students then logon with the exam account, and save the work into the R drive (the only they have)

once the CA is over the teacher clicks Lock and the program locks all the folders for that CA, the teachers can access that folder at any time

 

about 3 teachers are using at the moment and it seems ok, some small problems but easy corrected

i have a help file if anyone want to email me

Thanks

 

This sounds like a real good program. Sounds like it works well.

[GilRil]

thank you

[Kingstech]

thank you

 

Would you be able to email me the help file is i pm you?

[GilRil]

yes of course

[mrbios]

Just going to add my 2pence to this thread, this is how i did it:

 

I already have a large folder called teaching resources which is where students have read access and teachers have write access, this folders then divided up into departments "art, drama etc" and only the individual department has write access to their own folders.

 

anyway.... drama at the moment are doing CAs so i have a folder in the drama section called "controlled assessment 2012-13" under that a folder for the year and year group this folder has the following permissions:

a.	Domain Admins
i.	Full control
ii.	This folder, subfolders and files
b.	“Department Security Group” 
i.	Full control
ii.	This folder, subfolders and files
c.	Student
i.	Traverse folder/list folder/read attributes/read extended attributes/create folders/read change and take ownership
ii.	This folder only
d.	CREATOR OWNER 
i.	Traverse folder/list folder/read attributes/read extended attributes/create files/create folders/write attributes/write extended attributes/delete/read change and take ownership
ii.	Subfolders and files only 

 

Then i get the teacher to email me the lesson times that they'll be doing controlled assessments each week and setup a scheduled task on the file server to unlock and relock the folder for the students group (runs a little 1 line script).

 

Easy peasy, nice and quick, teachers have access to block internet themselves via impero or soon via lightspeed teacher portal. Covers all grounds i think...

 

EDIT: oh the way this works is that the students create the subfolders within the root controlled assessment folder and name it their name. That then gives them full access to that folder (but stops them deleteing it) while not allowing anyone else access.

Edited March 23, 2013 by mrbios