Locked Down Workstation for Exam Proctoring: OS Controls, Network Hardening, and Support Models

Exam integrity depends on the device in front of the candidate. A browser with a few restrictions is not enough when a determined test taker can open another window, run a virtual machine, share a screen, paste in answers, or plug in a USB drive. Whether you run an in-person test centre, a university computer lab, or a remote proctoring program, the workstation must be built so that the exam is the only thing it can do.

This guide covers how to lock down a proctoring workstation at the operating system level, how to harden the network around it, and how to choose a support model that keeps exams running without opening security gaps.

What a Locked Down Exam Workstation Must Achieve

A well-designed exam workstation should:

• Run only approved software, typically the exam client or a locked browser.
• Block unauthorized resources, including other applications, websites, messaging tools, AI assistants, and remote access software.
• Prevent data leakage, such as copying questions, screenshots, screen recording, printing, or file transfer.
• Resist tampering, including attempts to boot another OS, use external media, or change system settings.
• Return to a clean state after every session so nothing carries over between candidates.
• Stay reliable under pressure, because a crash mid-exam harms candidates and the institution.
• Produce evidence, with logs and monitoring that support integrity investigations.
• Respect accessibility and privacy, supporting assistive technology and complying with data protection rules.

Deployment Scenarios

The right design depends on where the exam happens.

Managed test centre or campus lab. You own the hardware and network. This gives the strongest control, and every layer in this guide can be applied.

Institution-issued devices. Laptops loaned to candidates. You control the OS but have less control over the room and network.

Bring-your-own-device (BYOD) with a secure browser. Candidates use personal machines. Control is limited to what the lockdown software can enforce, so risk is higher.

Bootable secure environment. Candidates boot a managed OS from USB, bypassing their installed system. This improves control on personal hardware but needs compatibility testing.

Virtual desktop for exams. Candidates connect to a hardened virtual desktop, keeping the exam environment off the local machine.

Choose based on the stakes of the exam. High-stakes certification and licensure usually justify managed hardware, while low-stakes quizzes may accept a secure browser on personal devices.

Operating System Controls

Choosing the Platform

• Windows: Broad exam software compatibility and mature management tooling. Assigned access and kiosk modes support single-app lockdown, and group policy offers detailed controls.
• Linux: Small footprint, strong lockdown potential, and no per-device licence fee. Suits custom test centre builds if you have the skills.
• ChromeOS: Managed kiosk sessions and automatic updates suit web-based exams with low maintenance.
• macOS and iPadOS: Support single-app and guided modes through device management, useful where the exam vendor supports them.

Confirm which platforms your exam vendor certifies. An unsupported OS can void support and cause failures.

Account and Privilege Controls

• Run exams under a standard, non-administrative account or an automatically created temporary profile.
• Disable local administrator access and block privilege escalation.
• Use auto-login to a dedicated exam account or a controlled sign-in workflow, so candidates never see a full desktop.
• Reset the profile at every logoff.

Application Control

• Allowlisting: Permit only the exam client, required system components, and approved accessibility tools. Block everything else by default.
• Block known risk categories: Remote access tools, screen sharing, messaging apps, virtual machines, emulators, debuggers, macro tools, and automation software.
• Disable scripting hosts and command-line access for exam accounts.
• Control browser extensions by removing them entirely or allowing a small vetted list.

Interface Lockdown

• Replace the standard shell with the exam application, or use kiosk and assigned access modes.
• Disable task switching, system hotkeys, the Windows key, and system menus where possible.
• Remove or hide the taskbar, start menu, notifications, and system tray.
• Suppress pop-ups, update prompts, and notification banners that could expose information or interrupt the exam.
• Block right-click menus, developer tools, print screen, and printing.
• Disable clipboard access between the exam and the rest of the system, and prevent clipboard history.

Screen and Recording Controls

• Block screenshot and screen recording tools.
• Detect and block virtual displays, mirroring, and extended monitors unless explicitly allowed.
• Prevent screen sharing and remote desktop sessions.
• Monitor for unauthorized capture drivers or virtual cameras.

Peripheral and Storage Control

• Block USB mass storage, external drives, and unapproved USB devices.
• Allow only the keyboard, mouse, headset, webcam, and approved assistive devices.
• Disable Bluetooth, unless required, and restrict wireless adapters.
• Block printers and file transfer.
• Disable or restrict smart card readers and other unneeded ports.

Firmware and Boot Security

• Set a BIOS or UEFI password and lock boot settings.
• Disable booting from external media.
• Enable Secure Boot and a trusted platform module to protect boot integrity.
• Use full-disk encryption on loaned laptops and any machines that store exam data locally.
• Physically secure the case where tampering is a concern.

Virtualization and Environment Detection

Exam clients often detect virtual machines, debuggers, and unusual environments. Build hardware to pass these checks, and block virtualization features on candidate devices where possible. For managed labs, hardware-level protections reduce the risk of VM-based cheating.

Clean State After Every Session

• Use a read-only or immutable system image so changes disappear on reboot.
• Apply profile reset or disk restoration technology that wipes user data between sessions.
• Clear browser caches, cookies, temporary files, and downloaded content.
• Reboot automatically after each exam.

Patching and Updates

• Apply updates during maintenance windows, never during an exam.
• Block automatic updates and forced restarts during sessions.
• Test patches against the exam client before wide rollout.
• Keep a controlled "exam freeze" period before major exam windows, so no changes are introduced close to exam day.

Accessibility

Lockdown must not lock out candidates who need assistance. Plan for screen readers, magnification, alternative input devices, extra time features, and text-to-speech. Whitelist approved assistive technology and test it in advance with the exam client.

Network Hardening

Even a locked workstation can be undermined if the network is open.

Segmentation

• Place exam workstations on a dedicated VLAN or network segment isolated from staff, guest, and administrative networks.
• Limit communication between workstations to block peer-to-peer collaboration.
• Separate management traffic from candidate traffic.

Default-Deny Traffic Rules

• Apply firewall rules that allow only the specific destinations the exam needs, such as the exam delivery platform, authentication services, content delivery networks, and licence servers.
• Block all other outbound traffic by default.
• Maintain an allowlist reviewed with the exam vendor, since required domains and IP ranges change.
• Block known proxy, VPN, tunneling, and anonymizer services.
• Block messaging, file sharing, social media, search engines, and AI tool domains during exams, as policy requires.

DNS and Web Filtering

• Use controlled DNS that resolves only approved domains during exam sessions.
• Apply web filtering and category blocking for unlisted content.
• Log DNS queries to help investigate suspicious activity.

Encryption and Authentication

• Require TLS for all exam traffic and validate certificates.
• Use network access control so only enrolled, trusted devices can join the exam segment.
• Prefer wired connections in test centres for stability and security. If Wi-Fi is required, use enterprise authentication and a dedicated, hidden or access-controlled SSID.
• Disable guest access and unmanaged devices on the exam network.

Capacity and Resilience

• Size bandwidth for peak concurrency, including simultaneous logins, large downloads, and proctoring video streams.
• Use redundant internet links and failover where exams are critical.
• Apply quality-of-service rules to prioritize exam and proctoring traffic.
• Consider local caching or on-site exam servers where internet reliability is poor.
• Plan an offline mode or recovery process, so candidates can resume without losing answers after an outage.

Physical and Wireless Security

• Lock down network ports in exam rooms and disable unused switch ports.
• Scan for rogue access points and unauthorized devices.
• In test centres, consider signal controls or policies for personal devices, in line with local regulations.

Monitoring and Logging

• Collect firewall, DNS, authentication, and endpoint logs centrally.
• Alert on blocked traffic spikes, unknown devices, and attempts to reach restricted services.
• Retain evidence in line with your integrity policy and applicable privacy laws.

Proctoring Integration

The workstation should support the proctoring method you use.

• In-person proctoring: Room layout, camera coverage, sightlines, and hardware that prevents shoulder surfing, such as privacy filters and spacing.
• Live remote proctoring: Webcam, microphone, and screen capture streamed to a proctor, requiring reliable bandwidth and device permissions that the lockdown allows.
• Recorded or automated proctoring: Session recording with AI flagging and human review of flagged events.
• Hybrid models: Automated monitoring with live intervention for flagged sessions.

Be transparent about what you capture. Recording video, audio, screens, and room scans involves sensitive personal data. Publish clear policies, obtain required consent, limit retention, secure stored recordings, and follow privacy laws and education regulations that apply to your candidates.

Support Models

Even the best lockdown fails without a plan for when things go wrong. The support model determines how fast issues are resolved without compromising security.

Model 1: In-House IT Support

Your own staff build, manage, and support the workstations.

Strengths: Full control, deep knowledge of your environment, and fast response for on-site problems.

Considerations: Requires skilled staff, after-hours coverage for exam windows, and ongoing investment in tooling and training.

Best for: Universities and organizations with established IT teams and regular exam schedules.

Model 2: Vendor-Managed Service

The exam or proctoring vendor provides the software, configuration standards, and sometimes the hardware and support.

Strengths: Certified configurations, vendor expertise, and reduced internal workload.

Considerations: Less flexibility, dependency on vendor response times, and ongoing service fees.

Best for: Organizations that want a turnkey approach for certification or licensure programs.

Model 3: Managed Service Provider (MSP)

A third party manages devices, patching, monitoring, and helpdesk.

Strengths: Scalable skills, defined service levels, and predictable costs.

Considerations: Needs strong contracts, security vetting, and clear escalation to exam owners.

Best for: Multi-site operations or organizations with limited IT staff.

Model 4: Hybrid Support

Internal teams own policy and day-to-day issues, while a vendor or MSP handles specialist work, surge capacity, or after-hours coverage.

Best for: Organizations balancing control with cost and flexibility.

Key Support Elements for Any Model

• Service level targets: Define response and resolution times, especially during exam windows.
• Exam-day support: Dedicated, on-call technicians and a direct escalation line to the vendor.
• Spare hardware: Keep ready-to-use replacement workstations at each site.
• Remote management: Monitor health, restart devices, and push fixes without disturbing active sessions.
• Incident procedures: Document steps for crashes, network outages, power loss, suspected cheating, and equipment tampering, including how to preserve candidate progress and evidence.
• Candidate communication: Provide clear instructions and a rapid route to help.
• Proctor training: Train staff to recognize technical problems versus suspicious behavior.
• Change control: Require approval and testing for every configuration change, with a freeze before major exam periods.
• Post-exam review: Analyze incidents, update configurations, and share lessons learned.

Rollout Steps

Step 1: Define exam risk and requirements. Classify exams by stakes and threats. Decide which controls are mandatory for each category.

Step 2: Confirm vendor requirements. Collect supported OS versions, hardware specifications, network requirements, and lockdown capabilities from your exam provider.

Step 3: Design the standard build. Define the OS, image, policies, application allowlist, peripheral rules, and update schedule.

Step 4: Harden the network. Build segmentation, firewall rules, DNS controls, and capacity plans.

Step 5: Create the golden image. Build, harden, and document a single master configuration, then protect it with version control.

Step 6: Test against attack scenarios. Try to escape the lockdown yourself. Test keyboard shortcuts, USB devices, virtual machines, screen sharing, alternate boot options, and network bypass attempts. Include accessibility testing.

Step 7: Pilot with a mock exam. Run a realistic session with real candidates or staff, full proctoring, and peak concurrency. Measure failures, support requests, and performance.

Step 8: Train staff and prepare support. Prepare runbooks, escalation paths, spare equipment, and exam-day staffing.

Step 9: Roll out in stages. Start with lower-stakes exams or a single site, then expand.

Step 10: Monitor and improve. Review logs and incidents, retest regularly as exam software and operating systems change, and update controls as new cheating methods emerge.

Common Pitfalls to Avoid

• Relying on a secure browser alone without OS and network controls.
• Leaving USB and boot options open, which defeats software lockdown.
• Over-broad network allowlists that let candidates reach forbidden resources.
• Ignoring accessibility, creating legal and fairness problems.
• Updating before exams, which can break compatibility on exam day.
• No clean-state process, allowing data to carry between candidates.
• Skipping adversarial testing, so weaknesses are found by candidates instead of staff.
• Undersized bandwidth, causing timeouts and lost sessions.
• Poor support planning, leaving candidates stranded during failures.
• Excessive surveillance without transparency, damaging trust and risking privacy violations.
• Treating the build as finished. Cheating methods, operating systems, and exam clients all keep evolving.

Conclusion

A locked down exam workstation is a layered system. The operating system limits what the machine can run and what the candidate can reach. The network allows only the traffic the exam needs. The proctoring approach adds oversight and evidence. The support model keeps everything running when something fails. No single control is enough, but together they make cheating difficult and exam delivery dependable.

Start by matching controls to exam stakes, test your own defenses before candidates do, plan accessibility and privacy from the beginning, and build a support structure ready for exam day. Done well, you protect the integrity of your credentials while giving candidates a fair, stable, and respectful testing experience.

Frequently Asked Questions (FAQ)

1. What is a locked down workstation for exam proctoring?
It is a computer configured to run only the exam software and block everything else. It restricts applications, websites, USB devices, screen capture, clipboard use, and system settings, and resets to a clean state after each session so candidates cannot cheat or carry data between exams.

2. Is a secure exam browser enough to prevent cheating?
Usually not for high-stakes exams. A secure browser helps, but without OS restrictions, peripheral controls, boot protection, and network filtering, determined candidates may find workarounds. Layered controls across the device, network, and proctoring process provide much stronger protection.

3. How should the network be configured for exam workstations?
Place workstations on an isolated VLAN, apply default-deny firewall rules, and allow only the domains and services the exam platform requires. Add controlled DNS, block proxies and VPNs, prefer wired connections, and size bandwidth for peak concurrency, including any proctoring video.

4. Which support model works best for exam delivery?
It depends on your size and skills. In-house support gives the most control, vendor-managed services offer certified, turnkey setups, and MSPs add scalable expertise. Many organizations use a hybrid model, combining internal ownership with specialist or after-hours support from a vendor or provider.

5. How do we balance lockdown with accessibility and privacy?
Whitelist and test assistive technologies with the exam client before exam day, and provide an accommodation process for candidates who need adjustments. For privacy, tell candidates exactly what is recorded, obtain required consent, limit data retention, secure recordings, and follow applicable data protection laws.

Work with eSparks IT Solutions

Planning a project around this? We work with businesses in the United States, Canada and the UAE, as well as the UK and Australia. See a related project: Phone Vault. Explore our Programming services and portfolio, estimate your project cost, or book a free call.