A complete office computer network, built from virtual machines by four students. I built the server that stores everyone's files and runs the company websites.
My role
File, storage and web server (DC2)
Team
Four students · Singapore Polytechnic
Timeline
AY2026/27, Semester 1
Platform
Windows Server 2025, Windows 11, VMware
Tools
Active Directory, IIS, FSRM, AD CS, PowerShell
Our network. Every machine is a virtual machine. DC2 is the one I built.
5shared folders, each only for the right team
3disks working as one, so a broken disk loses nothing
2secure websites with no browser warnings
4/4file-sync tests passed
Overview
For a school module, four of us set up the computer systems for a pretend office, the way an IT team would for a real company: staff accounts, shared folders, websites and secure access from home. Everything ran as virtual machines (computers simulated in software) on our laptops.
My job was DC2, the server that stores everyone's files and runs the company websites. Staff belong to three teams (Manager, Sales and Remote), and what each person can open or save depends on their team.
What I built
01
Files that survive a broken disk
I combined three disks into one drive, with the files spread across all three. If any one disk breaks, nothing is lost. Every shared folder lives on this drive.
RAID-5 · NTFS · Disk Management
Disks 0, 1 and 2 working together as one drive (E:), all healthy.
02
A folder for each team, ready at login
Each team has its own shared folder that other teams can't open: VIP for Managers, Logistics for Sales and IT for the Remote team. There's also Common, which everyone shares.
When staff log in, their folders appear as drives automatically. They don't have to set anything up.
File shares · NTFS permissions · Group Policy
A Remote team member just after logging in: their private folder (H:), the team's IT folder (X:) and the shared Common folder (Z:).
The folders, and who can do what
Folder
Who it's for
Shows up as
Who can open it
Who can save to it
What can be saved
Size limit
Common
Everyone
Z: drive
Everyone
Managers only
Only text files and web pages
10 MB
VIP
Managers
X: drive
Managers
Managers
Anything except programs and scripts
20 MB
Logistics
Sales team
X: drive
Sales team
Sales team
Anything except programs and scripts
20 MB
IT
Remote team
X: drive
Remote team
Remote team
Anything except programs and scripts
20 MB
Personal
Each person
H: drive
Only its owner
Only its owner
Anything
None
The IT administrator has full control of every folder. "Programs and scripts" means .exe, .bat and .ps1 files.
03
A size limit on every folder
Each team folder can hold up to 20 MB, and the shared folder 10 MB. Once a folder is full, nothing more can be saved, so one team can't fill up the whole server.
FSRM · Quotas
The limits I set: 20 MB for the Logistics, IT and VIP team folders, and 10 MB for Common.
04
Risky files blocked, and tested
Programs and scripts can carry viruses, so the team folders block them. Common only takes text files and web pages (see the table above).
To check the rules, I tried saving different kinds of files into two folders: Logistics (the Sales team's folder) and Common (everyone's folder).
Saved: a text file (.txt) in Logistics and in Common
Refused: a program (.exe) and a script (.ps1) in Logistics
Refused: a picture (.jpg) in Common, which only takes text and web pages
FSRM · File screens
My test in a command window. Each line tries to save one file: the .txt files saved (✓), and the .exe, .ps1 and .jpg files were refused with "Access denied" (✗).
05
A private folder for everyone
A script I wrote creates each person's private folder the first time they log in. The folders are hidden from everyone else, so people only ever see their own.
PowerShell · Access-Based Enumeration
The private folders' setting is "AccessBased", which hides other people's folders.
06
Secure company websites
I set up two company websites. Both open with the padlock in the address bar and no security warning, because they use certificates from our own certificate authority.
IIS · AD CS · HTTPS
Both websites open securely: see the padlock (boxed in red) next to each address.
07 · Extra feature
Files that sync between laptop and server
I set up Work Folders for the Remote team. It keeps a copy of each person's work files on both their laptop and the server, and syncs changes automatically, a bit like a company-run OneDrive.
All four tests passed. Each person's files stay private: even the IT administrator can't open them.
Work Folders · HTTPS
The administrator tries to open user rmt-001's synced folder and is denied, as intended.
Problems I fixed
Browsers didn't trust our websites
At first, browsers showed a security warning. Each website's certificate (its digital ID card) was missing a detail that browsers check.
Fix I requested new certificates with that detail included. Now browsers trust them.
The new certificate for test.wss07a.sg, issued by our own certificate authority (sp-root-ca).
A website that went round in circles
Sending visitors from the insecure address (http) to the secure one (https) also redirected the secure address, so the page never loaded.
Fix I made a tiny separate site whose only job is the redirect.
Two services, one door
The file sync and the websites both needed the same network "door" (port 443, used for secure web traffic).
Fix I set them up so the server can tell which service each visitor wants, and both work side by side.
What I learned
Keep the rules in one place. I set every access rule in one layer, so when something went wrong there was only one place to look.
Most website security problems are certificate problems. The certificate's details, and whether computers trust whoever issued it, both have to be right.
Test as a normal user. An admin account can open almost anything, so it hides mistakes.
