OSCP Proctored Exam Setup Checklist (2026): Disable Shared Clipboard, Drag-and-Drop & Shared Folders

OSCP Proctored Exam Environment Lockdown

Three toggles. Two minutes of fail-tests. One calm check-in.

This checklist is for the night-before moment when “Disabled” still feels like a guess—and guessing is what makes your hands shake at check-in. The problem isn’t skill. It’s uncertainty: shared clipboard, drag-and-drop, and shared folders can quietly stay available in VirtualBox or VMware if you changed the wrong profile, resumed a saved state, or reverted a snapshot.

Keep guessing, and you pay the worst exam tax: starting stressed, troubleshooting in public, and burning focus before the first target loads.

This post gives you a rule-safe, repeatable lockdown: disable the “Big 3,” power-cycle (not suspend), run simple “failures are success” verification tests, and capture a tiny OSCP proof pack screenshot workflow you can show without drama.

It’s change control for your nervous system—two passes, no surprises. Small steps. Clean environment. Boring setup. That’s the goal.

Now lock the doors. Then prove they’re locked.

---

1) Who this is for / not for

For you if…

• You’re taking an OSCP proctored exam and want a compliance-first VM setup you can repeat.
• You used convenience features in labs (clipboard sync, shared folders) and don’t trust “I’ll remember.”
• You want a 10-minute preflight that works when you’re running on coffee and adrenaline.

Not for you if…

• You’re not using a VM at all, or your exam environment is fully managed and you can’t change hypervisor settings.
• You want a study plan. This is setup compliance and “don’t surprise the proctor,” not learning strategy.

Tiny confession: the first time I sat down for a proctored technical exam (not OSCP—different beast, same nerves), I spent 12 minutes arguing with myself about whether “Disabled” really meant disabled. It wasn’t the tech that shook me—it was the doubt. This checklist exists to delete doubt.

---

2) Disable the “Big 3” first: clipboard, drag-and-drop, shared folders

Think of these three features like a backstage door at a concert hall. You might never use it, but if it’s unlocked, it changes what’s possible. Proctoring isn’t reading your mind—it’s observing your environment and capability. So we lock the door.

Shared Clipboard: disable + verify it’s truly dead

• Set Shared Clipboard to Disabled (not Bidirectional, not Host to Guest, not Guest to Host).
• Power off the VM completely, then boot it again. (Suspend/saved state is where settings go to hide.)
• Fail-test: copy a unique string on the host (example: CLIPBOARD-FAIL-4381) and try to paste in the guest. It should not paste.

Anecdote you might recognize: I once disabled clipboard, felt proud, then discovered the VM had been “saved” and politely ignored me. It’s like telling your future self “we’re starting a diet tomorrow” and then buying donuts tonight. Power off. Boot clean.

Drag-and-Drop: disable + verify it can’t silently move files

• Set Drag-and-Drop to Disabled.
• Fail-test: try dragging a harmless file (a tiny .txt) from host into the VM window. It should fail.

Why this matters: file movement can look like “outside assistance” even when it’s just you moving your own notes. Disable it so there’s nothing to misunderstand.

Shared Folders: remove mounts, not just “auto-mount”

• Delete shared folder entries entirely (don’t only uncheck auto-mount).
• Power-cycle the VM.
• Fail-test: look for typical shared mount points inside the guest and confirm they don’t exist.

A small, practical note: OffSec’s current proctoring requirements emphasize controlling what’s in your environment and what devices/screens are used during the session. Your job is to make your setup boring—in the best way. (Their Proctored Exam Requirements FAQ is worth reading once with a highlighter.)

---

3) The hidden “still sharing” switches people forget

Most people disable the Big 3… and still leave a little trapdoor open. Not because they’re sloppy—because virtualization tools love convenience, and convenience loves hiding in menus.

Guest tools & integrations that behave like sharing

VM “guest additions/tools” can enable clipboard syncing, drag-and-drop, and file integration. In many setups, those features are controlled by the hypervisor settings you already disabled— but it’s worth knowing what’s installed so you don’t get confused when something behaves oddly.

• If you see copy/paste working after disabling it, assume one of three things: the VM wasn’t fully powered off, the wrong VM profile was edited, or an older snapshot restored settings.
• 
  Keep your exam workflow independent of host-to-guest movement:
  store notes inside the VM using a stable system (for example, an Obsidian OSCP host note template),
  use the exam portal processes as intended, and avoid “I’ll just paste one thing.”
  

Show me the nerdy details

Clipboard and drag-and-drop in common desktop hypervisors often depend on guest-side services plus host-side integration channels. If the VM is suspended, those channels may remain established even after you “change” a setting. A cold power-off breaks the integration session. That’s why a fail-test after a power cycle is stronger evidence than trusting a toggle.

Network modes that feel harmless—but change your testing surface

This checklist isn’t a networking tutorial, but here’s the proctoring-relevant angle: surprise network behavior creates panic. Panic creates mistakes. Keep your VM networking stable and predictable.

• 
  If you’ve used multiple adapters (NAT + host-only + bridged) in labs, simplify.
  If you need a quick refresher on what each mode actually changes, keep
  VirtualBox NAT vs host-only vs bridged bookmarked so you don’t improvise under stress.
  
• Do not “experiment” with network settings on exam morning unless you truly have to.

Anecdote: I once swapped a VM from NAT to bridged “because it felt faster,” then spent 9 minutes wondering why a route changed. It wasn’t a huge problem—just a needless tax on focus. Don’t pay taxes you didn’t owe.

Snapshots & templates that re-enable settings behind your back

Snapshots are time machines. Time machines don’t care about your compliance intentions. If you revert to an older snapshot, treat it like you just installed a fresh VM: re-check the Big 3 immediately.

---

4) What proctors notice (and what they don’t tell you upfront)

The compliance lens: “Can the host help you?”

Proctors aren’t looking for perfection. They’re looking for obvious risk. If your host can feed your VM text and files easily, it can look like assistance—even if it’s just your own notes. That’s why this post frames compliance as capability, not intention.

Proof beats vibes: build a tiny “evidence pack”

You don’t need a binder. You need a small, calm set of artifacts you can pull up if asked:

• Screenshot of VM settings showing Shared Clipboard = Disabled
• Screenshot of Drag-and-Drop = Disabled
• Screenshot of Shared Folders list showing no entries
• 
  A one-line note: “Fail-tested at 07:15 local; paste + drag/drop failed.”
  (If you want this to be effortlessly consistent, use the same
  OSCP proof screenshot naming and packing routine every time.)
  

Anecdote: I’ve watched smart people talk themselves into a spiral because they had “proof in their head” but nothing visible. Screenshots are cheap. Calm is expensive. Buy calm.

Here’s what no one tells you (but your future self will love)

Even if you disabled settings once, a restore, update, or new VM profile can flip them back. The safest habit is a two-pass check: night-before + exam-day. It’s not paranoia. It’s basic change control.

---

5) 10-minute “two-pass” preflight you can run under stress

This is the checklist you can run half-asleep. The goal is not elegance; it’s repeatability.

Pass A (night before): set → reboot → fail-test

1. Disable Shared Clipboard.
2. Disable Drag-and-Drop.
3. Remove Shared Folders entries.
4. Power off the VM (not saved state).
5. Boot and run the three fail-tests (paste, drag/drop, shared folder path check).
6. 
   Capture screenshots (your proof pack).
   If you want a “no thinking required” system, store them using a consistent structure like
   report-ready OSCP evidence screenshots.
   

Pass B (exam day): confirm nothing drifted

1. Open VM settings and confirm the Big 3 are still Disabled.
2. Run the fail-tests again. Time target: under 2 minutes.

Let’s be honest: at 6:58 AM, you won’t remember what you changed at 11:42 PM. You also won’t want to troubleshoot. This is why we do Pass B.

Anecdote: my favorite trick is writing the fail-test string on a sticky note (real paper). Something like “CLIPBOARD-FAIL-4381.” When it doesn’t paste, it’s weirdly soothing. Like hearing the first note of a familiar song in a noisy room.

---

6) Common mistakes (the ones that cause “panic debugging” on exam day)

Mistake: turning off “auto-mount” but leaving the shared folder entry

• Why it bites: The folder definition still exists; future toggles or tools can re-mount it.
• Fix: Remove the shared folder entry entirely, then power-cycle the VM.

Mistake: changing settings while the VM is “saved” or suspended

• Why it bites: Integration channels can remain alive in a saved state.
• Fix: Fully power off, apply changes, boot clean.

Mistake: copying notes from host without realizing clipboard is still bidirectional

• Why it bites: The toggle might not have applied, or you changed the wrong VM profile.
• Fix: Confirm paste fails (don’t trust the toggle alone).

Mistake: reverting a snapshot that reintroduces sharing

• Why it bites: Snapshots restore configuration states along with system state.
• 
  Fix: Rerun Pass B after any revert—no exceptions.
  (This is the same “don’t disappear into side quests” discipline behind the
  OSCP rabbit hole rule—tight loops beat heroic guessing.)
  

Anecdote: I once tried to be clever and keep my VM suspended to “save time.” It saved 45 seconds and cost me 8 minutes of confusion later. That’s a terrible trade. The exam is already hard; don’t add self-made puzzles.

---

7) Don’t do this: “convenience hacks” that backfire

Don’t rely on “I won’t use it” compliance

This is the big mindset shift: proctoring is about what your environment allows, not what your intentions are. If a feature is available, it creates ambiguity. Disable it so the story is simple.

Don’t build your exam workflow around host-to-guest movement

If your workflow depends on pasting commands from a host notes app into the guest, redesign now. Put your notes inside the VM. Use a text file in the guest. Keep your “working memory” inside the environment you’re being evaluated in— and if you want it structured, use something like an Obsidian OSCP enumeration template instead of scattered host notes.

Don’t wait until check-in to discover your settings are wrong

The earlier you catch it, the calmer your exam start. Calm is performance. Performance is points.

---

8) Quick verification tests (failures are success here)

These tests are intentionally simple. You’re not proving cryptography. You’re proving convenience is dead.

Clipboard test (30 seconds)

• Copy a unique string on the host (example: CLIPBOARD-FAIL-4381).
• Try to paste in the guest.
• Expected result: paste fails, nothing appears.

Drag/drop test (30 seconds)

• Drag a tiny harmless file from host into the VM window.
• Expected result: it doesn’t transfer.

Shared folder test (60 seconds)

• Check for any known shared folder mount points you’ve used in labs.
• Look for suspicious “host” paths exposed inside the guest file browser.
• Expected result: nothing host-like exists.

Anecdote: the first time I did these fail-tests back-to-back, it felt like closing three windows and suddenly hearing silence. It’s not dramatic—it’s relief. And relief is a resource.

Short Story: The morning my own checklist saved me (120–180 words) …
I woke up early, smugly confident, and did the exam-day Pass B “just to be safe.” Clipboard: disabled. Drag-and-drop: disabled. Shared folders: none. I was about to close settings when I noticed I’d opened the wrong VM profile—the one I used for labs, with all the convenience turned on like a cozy fireplace. My exam VM was fine; my muscle memory was not.

I switched to the correct VM, re-ran the fail-tests, and felt my shoulders drop. Nothing heroic happened after that. That was the point. The exam started with a clean mind instead of a small internal argument. Later, when fatigue hit, I didn’t have to wonder if I’d accidentally crossed a line. The checklist didn’t make me smarter. It made me calmer. Calm turned into time. Time turned into better decisions.

---

FAQ

---

10) Conclusion + next step

Remember the curiosity loop from the beginning—the quiet fear that one forgotten toggle could wreck your start? Here’s the truth: it’s rarely the toggle itself. It’s the uncertainty. Your fix is not more willpower. It’s a repeatable two-pass routine that turns compliance into muscle memory.

A one-screen infographic you can glance at under pressure

If you want the most boring, professional check-in possible, skim two official references once so you know what the proctoring tool expects from your screens and environment— and keep a vendor doc handy if you’re on VMware or VirtualBox and need to flip a setting quickly.

Your next step (15 minutes): Run Pass A tonight—even if your exam isn’t tomorrow. Do the three fail-tests. Save three screenshots. Put the proof pack somewhere you can open in two clicks. Then run Pass B once in the morning, just to confirm nothing “time-traveled.”

Last reviewed: 2026-01.