Shared Library PCs: File System Choice and Per-Member Permissions
Sunrise Public Library has six shared Windows 11 computers. Members save assignments in a common folder D:\Shared on each PC. The library also keeps a 2 TB external USB drive for the video club. Two problems have appeared. First, videos larger than 4 GB cannot be copied to the external drive, although it shows 1.2 TB free. Second, last month a member accidentally deleted another member's project folder, and there is no way to tell who did it. The librarian wants members to read all files, write only to their own folder, and not delete others' work. She also wants the video club to use the same drive on both Windows and Mac laptops. The library has no server and no internet-based storage. A volunteer suggests formatting the external drive as NTFS, another suggests FAT32, and a third suggests exFAT. The shared PCs are not domain-joined; all members currently use one common Windows account called 'Member'.
1. Choose the file system for the 2 TB external drive and justify it against NTFS, FAT32, and exFAT, given the 4 GB failure and the need to use the drive on Windows and Mac laptops.
Read the worked answer
Use exFAT. The 4 GB failure is the signature of FAT32, whose maximum single-file size is 4 GB minus 1 byte. exFAT removes that limit, so a 12 GB video copies normally. It is also read/write on both Windows and macOS without extra drivers, which matters because the video club uses both.
NTFS would solve the 4 GB limit on Windows, but macOS only reads NTFS by default; writing requires third-party software or risky workarounds. That fails the cross-platform requirement. FAT32 is readable everywhere but cannot store files above 4 GB, so it fails the main symptom. exFAT has weaknesses - no journaling and no per-file permissions like NTFS - so it is suitable for a media-transfer drive, not for a security boundary. The library should keep a second copy of important videos because exFAT is more vulnerable to corruption after unsafe removal. The drive should be formatted only after copying existing data elsewhere, and users should use 'Safely Remove Hardware'.
2. Design a folder and permission scheme on each Windows 11 PC so that members can read all files but write and delete only their own, using only local accounts. State exactly what must change from the current setup.
Read the worked answer
The current single 'Member' account makes the goal impossible: Windows permissions apply to the account, so every member is the same security principal. The first change is to create individual local standard accounts (for example, member01 to member20), each with its own password, and stop auto-login to 'Member'. Keep one administrator account for the librarian.
On each PC, create D:\Shared with subfolders named after each member. Disable inheritance on each subfolder. Grant Administrators and SYSTEM Full Control; grant the matching member Modify on their own folder; grant the group 'Members' Read & Execute on D:\Shared and on each subfolder, but do not grant Write or Delete to others. Test with two accounts: member01 must open member02's file but get 'Access denied' when saving or deleting inside member02's folder. Because each person now logs in separately, the Windows Security log can show who deleted a file. This does not stop a determined member from using another person's logged-in session, so members must lock the screen when leaving.
3. The volunteer says, 'Just set the whole Shared folder to Read-only for everyone; that solves deletion.' Explain why this fails the library's needs and give one backup measure that would have limited last month's loss.
Read the worked answer
Read-only for everyone stops deletion, but it also stops members from saving their own work into D:\Shared, which is the folder's purpose. The video club also needs to write large files. A read-only shared folder would force members to save to USB drives or the desktop, recreating the same uncontrolled storage problem. It also does not identify who did what, because the common 'Member' account remains.
A better control is a backup with version history. Since there is no server, the library can enable Windows File History to an external drive, or schedule a simple robocopy job that copies D:\Shared to a separate backup drive each evening and keeps dated folders. The key is to test a restore, not just create copies. If a folder is deleted at 3 p.m., the morning copy still exists. For the video drive, keep two copies on separate drives and store one off-site. The backup does not replace permissions, but it reduces the loss from accidental deletion to a few hours of work.