My sister called me last spring because her kids could see every file on the family Synology, including a folder literally named "Divorce Paperwork". Everyone had been logging in as "admin" because that was the account set up at the store. One shared login, zero boundaries, and a teenager who had already found the photos folder.
That is the single most common state I find a home NAS in. It works, technically, so nobody touches it. Then something private shows up in the wrong place and the panic starts.
Fixing it takes about twenty minutes. Here is how I set up users, groups, and folder permissions on a Synology so each person gets exactly the access they should have.
Understand the three pieces before you click anything
On a Synology running DSM, access is built from three parts: users, groups, and shared folder permissions. A user is a person. A group is a bucket of people. A shared folder is a top-level folder like "Photos" or "Documents".
Permissions get assigned to the folder, and they can point at either a user or a group. That last part is the trick most people miss.
If you assign everything directly to individual users, you will be editing permissions forever every time someone new arrives. Assign to groups instead, and adding a person becomes a single checkbox.
Step 1: Create an admin account that is actually yours
Open Control Panel > User & Group. The default "admin" account is a well-known target for anyone scanning the internet, so I never leave it in daily use.
Create a new user, give it a real name like "dane", set a strong password, and add it to the administrators group. Log out, log back in as that new account, and confirm you can reach Control Panel. Only then go back and disable the original "admin" account.
This one change also quietly improves your security. Backblaze has a good plain-English explainer on why redundancy and access hygiene matter together, and it is worth five minutes if you are new to any of this.
Step 2: Create a user for each person
Still in User & Group, click Create for every human who touches the NAS. One login per person. No shared accounts, ever.
The reason is not just privacy. When each person has their own login, you can see who deleted the vacation photos, you can reset one password without disrupting everyone, and you can revoke a single account when a kid goes off to college or a roommate moves out.
Give the ordinary users a plain, non-admin account. Only you and maybe one other trusted adult should be in the administrators group.
Step 3: Build groups that match how your household actually works
Groups are where the whole thing gets easy. Think about the natural clusters of people in your home, then create a group for each.
In most families I set up three: adults, kids, and everyone-media. The adults group gets the sensitive stuff. The kids group gets homework and their own media. The media group covers movies and music that literally everyone can watch.
Go to the Group tab, create each group, and drop the right people into them. A person can belong to several groups at once, which is exactly what you want.
| Group | Who is in it | Typical folders |
|---|---|---|
| administrators | You, one backup adult | Everything, including system settings |
| adults | Parents, partners | Documents, Finances, Photos |
| kids | Children | Homework, Kids-Media |
| everyone-media | All accounts | Movies, Music, Family-Photos |
Step 4: Set permissions on the shared folders
Now open Control Panel > Shared Folder. Select a folder, click Edit, and go to the Permissions tab. Switch the dropdown from "Local users" to Local groups.
For a folder like "Finances", give the adults group Read/Write and leave everyone else with No access. For "Movies", give everyone-media Read Only. For a homework folder, give kids Read/Write so they can save their own work.
Assign to groups here, not individuals. When a new person arrives later, you add them to a group and every folder permission follows automatically.
Step 5: Watch out for the permission conflict trap
Here is the mistake I see constantly. Someone puts a person in two groups where one group says Read/Write and another says No access to the same folder. Then they are shocked when access does not work the way they expected.
On Synology DSM, No access always wins. If any group a user belongs to is set to No access on a folder, that user is blocked, full stop, even if another group grants them full rights.
So if your teenager is in both "kids" and "everyone-media", and "kids" has No access to the Finances folder, they are correctly locked out. But if you ever set a broad group to No access on a folder your adults need, your adults get locked out too. Check the effective result, not just the checkboxes.
How to actually test it
Do not trust the settings screen. Log in as one of the ordinary users, ideally on a phone in a private browser, and try to open each shared folder over the network.
On Windows, map the drive with that user's credentials. If a folder you meant to hide shows up, or one you meant to share is missing, go back and fix the group assignment. Five minutes of testing saves a very awkward conversation later.
A quick word on how people connect
Most home users reach the NAS over SMB, the standard Windows and macOS file-sharing protocol. The permissions you just set apply to SMB automatically, which is why getting them right at the folder level matters so much. If you want the technical background, the SMB overview on Wikipedia is solid.
QNAP users, the same logic applies almost exactly. The menu is called Control Panel > Privilege > Users and Groups, and folder rights live under Shared Folders. Groups first, then folder permissions, then test.
Keep it tidy going forward
The setup is not really finished, it just goes quiet. Every few months, open User & Group and ask whether every account still belongs to someone in your house.
Old accounts are the ones that leak. A disabled account costs nothing and removes a door nobody is watching. When my sister and I finished her DS220+, the divorce folder was locked to the adults group, the kids had their own space, and nobody had to log in as "admin" ever again. That is the whole goal: the right people in, the wrong eyes out, and a system you can hand off without a manual.
Frequently asked questions
Should I delete the default admin account on my Synology?
Disable it rather than relying on it, but only after you have created a second account in the administrators group and confirmed that account works. The default admin is a common target for automated attacks, so taking it out of daily use is smart. Just never remove your only way back in.
Why can a user still not see a folder even though I gave their group Read/Write?
Almost always it is a group conflict. If that user belongs to another group that is set to No access on the same folder, DSM blocks them, because No access overrides everything else. Check every group the person is in, not just the one you edited.
Do I need to use Windows ACL permissions at home?
Usually not. The three simple levels (No access, Read only, Read/Write) cover almost every household need. Only turn on ACLs if one specific file inside a shared folder needs different rules than the rest of that folder.
How do I give each family member a private folder quickly?
Enable the user home service under Control Panel, User and Group, Advanced. Every account then gets a private 'home' folder that only that person and administrators can see. It saves you from building custom permissions for each person.
Do these permissions apply when connecting from a Mac or a phone?
Yes. Whether you connect over SMB from Windows, from a Mac, or through the mobile apps like DS file, the folder and group permissions you set are enforced the same way. The rules live on the NAS, so the device does not change them.
