My first Synology sat happily on the shelf for three weeks before I touched a single setting beyond the wizard. Then a family member deleted a folder of photos, I had no snapshots, and I learned the hard way that the default configuration is built to get you running fast, not to keep you safe.
That gap between working and safe is where most new owners lose data or leave the front door wide open.
So here is the short list I now run on every new box, in the order I do it. Each one takes a few minutes, and together they turn a stock DSM install into something you can actually trust with your files. I am using Synology DSM 7 names here, but the same ideas map cleanly onto QNAP, TrueNAS, and UGREEN NAS OS.
1. Kill the default admin account
The very first thing attackers try is a login called admin with a weak password. It is the single most probed username on any NAS, and leaving it active is like taping your key under the doormat.
During DSM setup you created your own account. Log in with that, go to Control Panel > User & Group, and confirm the built-in admin account shows as disabled. If it is active, disable it, do not just rename it.
While you are there, make sure your own account uses a long passphrase. I aim for four random words plus a number, something like copper-otter-lantern-92, which is easy to type and miserable to brute force.
2. Turn on two-factor authentication
A strong password is good. A password plus a code from your phone is the thing that actually stops a stolen credential from becoming a stolen NAS.
Go to your personal account settings (click your name, top right, then Personal) and enable 2-Factor Authentication. DSM walks you through scanning a QR code with an app like Google Authenticator or Aegis. The whole process takes about two minutes.
Do this before you ever expose the NAS to the internet. The first time I set up remote access without 2FA, my logs showed failed login attempts from three continents within 48 hours. That is normal, and 2FA is what makes those attempts pointless.
3. Enable snapshots on your shared folders
This is the setting I care about most, because it is the one that would have saved my photos.
A snapshot is a point-in-time copy of a folder that takes almost no space and lets you roll back a file, or an entire share, to how it looked yesterday. On Synology this needs a Btrfs volume, which is the default on most models sold in the last several years.
Install Snapshot Replication from Package Center, then set a schedule per shared folder. A sensible starting point looks like this.
| Setting | My default | Why |
|---|---|---|
| Frequency | Every 4 hours | Catches mistakes fast without clutter |
| Retention | Keep 24 hourly, 7 daily, 4 weekly | About a month of coverage |
| Immutable lock | On, 7 days | Ransomware cannot delete locked snapshots |
Snapshots cost you a little disk space and give you back your afternoon the day someone overwrites the wrong spreadsheet. It is the best trade in the whole DSM interface.
4. Fix the notification settings
A NAS that fails quietly is worse than no NAS at all. You want it shouting at you the moment a drive gets sick.
Under Control Panel > Notification, set up email alerts and, if you use it, push notifications through the Synology mobile app. Send yourself a test message to confirm it actually arrives, because a typo in the SMTP settings is silent until the day it matters.
Turn on alerts for storage health, volume status, and failed logins at minimum. The first sign of a dying drive is usually a bad sector warning weeks before total failure, and that early heads-up is the difference between a calm drive swap and a scramble.
5. Control how updates install
Default DSM behavior on some models is to auto-install updates overnight. That sounds great until an update reboots your NAS in the middle of a backup, or a bad point release breaks a package you rely on.
In Control Panel > Update & Restore, I set it to download updates automatically but ask before installing the major ones. Security patches for DSM itself can auto-apply. Big version jumps wait until I have a free evening and a fresh backup.
Synology publishes a plain-language guide to DSM update options if you want the exact meaning of each toggle.
6. Change the default ports and disable what you do not use
Every service you leave running is a door. Most home users need a fraction of what DSM enables by default.
- Turn off SSH and Telnet unless you actively use them, then turn them back off when you finish.
- Disable SMB 1, the ancient file-sharing protocol behind several famous ransomware outbreaks.
- If you access the NAS remotely, avoid mapping the default ports 5000 and 5001 straight through your router. Use Synology QuickConnect or a VPN instead.
Under Control Panel > Security > Account, also switch on auto-block, which bans an IP after a set number of failed logins. I use five attempts within five minutes, block for a day. Those login attempts from three continents I mentioned earlier? Auto-block is what made them stop.
7. Set up a real backup target
Snapshots protect against mistakes. A backup protects against fire, theft, a failed volume, and the ransomware that got past everything else.
Open Hyper Backup and point it at a second location. That can be an external USB drive you rotate, a second NAS at a friend's house, or a cloud target like Backblaze B2 or Synology C2. Schedule it nightly and, again, send a test run so you know it works.
The rule I live by: if your data does not exist in at least two places, it does not really exist. A five dollar per month cloud bucket is cheap insurance against losing a decade of photos.
A sensible order to do all this
If you only have twenty minutes today, do the account and 2FA first, then snapshots. Those three cover the two failure modes that hurt most, a break-in and a human mistake.
Come back on the weekend for notifications, updates, port cleanup, and the backup job. None of it is hard, and once it is done you will stop thinking about your NAS as a gadget and start trusting it as the quiet, reliable box it is supposed to be. Mine has run untouched for two years since I started doing this, and the only time I noticed it was the afternoon it let me undelete a folder in about thirty seconds.
Frequently asked questions
Do I really need to disable the admin account if I have a strong password?
Yes. The admin username is the most commonly guessed login on any NAS, so attackers can focus their attempts on cracking just the password. Disabling it entirely, and using your own named account instead, removes that target completely. It takes under a minute and closes the most probed door on the box.
Will snapshots slow down my NAS or fill up my drives?
Snapshots use copy-on-write, so they only store the changes between versions rather than full copies. Day to day the performance impact is negligible for home use. Space grows slowly, and with a sensible retention policy of about a month you will typically use a small fraction of your volume.
What is the difference between a snapshot and a backup?
A snapshot is a point-in-time version that lives on the same drives as your data, ideal for undoing an accidental delete or overwrite. A backup is a separate copy on different hardware or in the cloud. Snapshots do not survive a failed volume or a stolen NAS, which is why you need both.
Should I let DSM install updates automatically?
Let security patches for DSM install automatically, since they close known vulnerabilities. Hold major version upgrades until you have a recent backup and a free evening, because a bad release can occasionally break a package you depend on. The download-but-ask-before-installing setting gives you the best of both.
Is it safe to access my NAS from outside my home?
It can be, but not by opening the default ports 5000 and 5001 straight to the internet. Use QuickConnect or, better, a VPN back into your home network, and always enable 2FA and auto-block first. Those layers turn constant automated login attempts into harmless noise.
