Lab Server: File System Limit, Hidden Extensions and Over-Broad Rights
Sunrise Vidyalaya's computer lab has 24 Windows 11 machines on a lab server. The office keeps the year's mark statements in the shared folder D:\Office\Marks. Three problems appeared in one week. (1) A teacher tried to copy a 6.2 GB recorded lecture to a 32 GB pen drive and Windows refused, saying the file is too large for the destination file system, although the drive showed 27 GB free. (2) A student's file named practical-record.txt turned out to be a program that ran when double-clicked; the office PC is set to hide known file extensions. (3) A student deleted two mark statements from the shared folder, because the account used in the lab has Full Control on the folder - 'it was easier that way'. The principal wants a written fix that needs no new hardware and does not stop students saving their own practical files on the same server. Backups are daily incremental plus weekly full, on an external disk kept in the same room.
1. Diagnose problem 1 fully and recommend a fix, comparing the available options and their trade-offs for a school that also uses the drive with projectors and a smart TV.
Read the worked answer
Diagnosis. The free space is not the limit; the file system is. The drive is formatted FAT32, which caps a single file at 4 GB minus 1 byte, so a 6.2 GB video cannot be copied however much space is free. FAT32 itself supports volumes far larger than 32 GB, so the 27 GB free figure is irrelevant to this error.
Options.
- Format as exFAT - no practical 4 GB cap, read/write on Windows and macOS, and most modern projectors and smart TVs read it. No journaling, so always use 'Safely Remove Hardware'; a power cut during a write can damage the file table.
- Format as NTFS - journaling, permissions, better recovery, but macOS mounts it read-only by default and many TVs, car stereos and older projectors cannot read it at all.
- Keep FAT32 and split or shrink the file - 7-Zip split volumes or re-encode the lecture at a lower bitrate. Ugly for a teacher, but keeps maximum device compatibility.
Recommendation. Because the same pen drive goes to the projector and the smart TV, format it exFAT, after copying the existing files to the server first (formatting erases them). Choose NTFS only if the drive will be used on Windows PCs alone.
2. Explain problem 2: what the file actually is, why the office saw only practical-record.txt, and what settings and habits you would change.
Read the worked answer
What the file is. Windows hides extensions it recognises. The true name is almost certainly practical-record.txt.exe (or .scr or .bat): the real extension is the last one, so double-clicking launches an executable, while the visible name ends in .txt and looks harmless. A genuine text file cannot execute; the '.txt' is a disguise.
Why it worked. The default View setting in File Explorer has 'Hide extensions for known file types' ticked, so the operator never sees the final extension. The student relied on that default plus human trust of a familiar file name.
Fixes.
- File Explorer > View > Show > File name extensions - enable on every lab PC, and set it in the default user profile so new logins inherit it.
- Check Properties/Details before opening unexpected attachments; verify the file type column.
- Never run a file received with a practical submission; save it to a scan folder first and let the antivirus finish.
- Block execution from the students' shared folder (Windows Defender Application Control or a Software Restriction Policy), so even a successful double-click cannot run.
- Set a lab rule: submissions are opened only after scanning, and staff are trained to look at the extension, not the icon.
3. Redesign the permissions for problem 3. Show what rights each group gets, explain share versus NTFS permissions, and say how the deleted statements are recovered plus one weakness in the current backup plan.
Read the worked answer
Principle: least privilege. Create groups Students and OfficeStaff rather than giving rights to individual accounts.
| Folder | Students | OfficeStaff |
|---|---|---|
| D:\Office\Marks | Read & Execute only; deny Write, Modify, Delete | Modify (not Full Control - Full Control would let them change permissions) |
| D:\Students<RollNo> | Modify on their own subfolder only | Read |
The principal's constraint is met because students write to their own folder, not to the marks folder.
Share vs NTFS. Share permissions apply only when the folder is reached over the network; NTFS permissions apply locally and over the network. When both exist, the more restrictive of the two wins. So set Share = Read for Students (Change for staff) and NTFS as in the table - changing only the share leaves a local logon wide open, and changing only NTFS leaves the share permissive.
Recovery. Restore the two deleted files from the most recent backup set (weekly full plus the daily incrementals); check the date of the last incremental so you restore the newest copy. Also check the server's Previous Versions (Volume Shadow Copy / Recycle Bin on the share) first, which is faster.
Backup weakness. Both the server and the backup disk sit in the same room and the disk is permanently attached: a theft, fire, flood or a ransomware infection that reaches mapped drives destroys the original and the backup together. Move one copy off-site or to cloud storage, and disconnect or rotate the external disk.