Shared Folders, Users & Permissions - Who Sees What

What a Shared Folder Really Is

A shared folder is the most important idea in this whole guide, so let us make it stick. Picture a filing cabinet - your NAS - full of drawers. Each drawer has a label on the front. A shared folder is one of those labeled drawers.

The word "shared" does not mean everyone can see it. It means it is a folder the NAS can hand out keys to. You decide who gets a key to each drawer, and whether their key lets them only look inside or also add and remove things. One drawer might be open to the whole household; another might open for you alone.

• Family Photos - a drawer everyone in the house can open.
• Household Documents - open to the adults, closed to the kids.
• Taxes - a drawer only you hold the key to.

Creating a Shared Folder

Making a new drawer is one of the friendlier jobs on the NAS. You do it in Control Panel, and DSM walks you through it with a short wizard - a series of simple screens.

Do not worry about getting every option perfect the first time. The name and the permissions are the parts that matter, and both can be changed afterward. The advanced options can be left at their sensible defaults.

• Open Control Panel from the Main Menu.
• Find and open the "Shared Folder" section.
• Click "Create" to start a new folder.
• Give it a clear name, like "Family Photos."
• Choose which drive location it should live on, if asked.
• Set who can use it - you can adjust these permissions now or later.

The Default Folders - home, homes, and photos

When your NAS was set up, a few folders may have been created automatically. It helps to know what they are so you do not mistake them for something you made - or accidentally delete them.

The key thing to understand: "home" is personal and private, while a folder you create and share is meant to be handed out. Leave the system-managed folders alone unless you have a clear reason and know what you are doing.

• home (lowercase) - your own private folder, just for the account you are signed in as.
• homes - a parent folder that holds everyone's private home folders. This one is managed by the system.
• photo or a photos folder - created when a Synology photo app is installed, for storing pictures.

User Accounts vs. the One Admin Account

Every person who signs in to the NAS does so as a user account. There is one special account, called admin, that can control everything. Understanding the difference keeps your NAS both usable and safe.

The wise habit is this: keep the powerful admin account for setup and repairs, and make a normal user account for your day-to-day use - even for yourself. That way an everyday mistake or a stray click cannot accidentally change the whole system.

Creating a User

When you want to give someone their own sign-in - a spouse, a child, a coworker - you create a user account for them. It gives them their own name, their own password, and their own private space.

Give each person their own account rather than sharing one login. It keeps their private Home folder truly private, lets you set different permissions for different people, and makes it easy to remove one person's access later without disturbing anyone else.

• Open Control Panel from the Main Menu.
• Open the "User & Group" section.
• Click "Create" to add a new user.
• Enter their name and set a starting password.
• Choose which shared folders they may use, and whether they can look or also change.
• Optionally set a size limit (a quota), covered later in this guide.

Using Groups to Save Time

If you have more than two or three people, groups become a real time-saver. A group is simply a named bundle of users, so you can set permissions for the whole bundle at once instead of one person at a time.

Imagine a group called "Family" that includes everyone in the house. Give the Family group access to the Family Photos folder, and every member gets in automatically. Add a new family member to the group later, and they inherit that access without you touching each folder again.

• Households - an "Adults" group and a "Kids" group with different access.
• Small businesses - a group per department, like "Office" or "Sales."
• Any time several people should be treated the same way.

Read/Write vs. Read-Only Permissions

When you give someone a key to a drawer, you also decide how much that key does. This is the heart of permissions, and it comes down to two everyday choices.

Choose read-only when you want people to see something but not alter it - like a photo album everyone can enjoy but no one can accidentally erase. Choose read/write for folders where people genuinely need to add and edit, like a shared work project. And no access simply keeps a folder out of sight.

How Conflicting Permissions Resolve - Deny Wins

Once you use groups and individual settings together, a person can end up with two rules that disagree. There is one simple law that settles every such argument, and it is worth knowing by heart.

The rule is: deny wins. If any rule says a person is denied access to a folder, that denial overrides any other rule that would allow it. It does not matter that a group they belong to is allowed - a specific denial still shuts the door.

Each Person's Private Home Folder

Alongside the shared drawers everyone can be given keys to, each user gets one drawer that is theirs alone: their Home folder. It is private by design, and it is a lovely feature once you understand it.

When a person signs in, they automatically get a folder simply called "home." Only that person - and the admin - can see inside it. It is the perfect place for anything personal that should not sit in a shared folder: private documents, personal photos, a spot to keep their own things separate from the family pile.

• Everyone gets private space without you creating a folder for each person.
• Nothing extra to set up - it appears when the account is made.
• It keeps personal items out of the shared drawers automatically.

The Recycle Bin on a Shared Folder

Just like the recycle bin on your computer, a shared folder can keep deleted files for a while instead of erasing them right away. It is a quiet safety net that has saved many a file, and it is worth turning on.

When the recycle bin is enabled for a folder, a file someone deletes is moved into a hidden recycle area rather than vanishing. If it turns out the file was needed, you can fish it back out. This option is usually offered when you create a shared folder, and can be switched on for existing folders too.

• Turn it on for folders holding important, hard-to-replace files.
• Remember it does use some storage space, since deleted files are kept a while.
• You can empty it, or set it to clear old items automatically, to reclaim space.

Encrypting a Shared Folder - and the Key You Must Not Lose

For a folder holding truly sensitive things - financial records, private documents - the NAS can scramble its contents so they are unreadable without a key. This is called encryption, and it is powerful protection when used with care.

When you encrypt a shared folder, DSM gives you an encryption key - think of it as the one and only master key to that scrambled drawer. You must keep that key safe. Without it, even you cannot open the folder. The option to encrypt is usually offered when creating a shared folder.

• Save the encryption key somewhere secure and separate from the NAS itself.
• Do not store the only copy of the key on the NAS it protects.
• Understand the folder may need to be unlocked after a restart.

Turning the Guest Account Off

The NAS comes with a built-in account called guest, which allows access without a real sign-in. For almost every home and small business, you want this account switched off - and it usually is by default.

The guest account exists for certain open-sharing situations, but leaving it on can let people reach folders without proper credentials. Unless you have a specific, deliberate reason to use it, keeping it disabled is the safer choice. You can check and change this in the User section of Control Panel.

• Everyone who uses the NAS should have their own named account.
• A disabled guest account is one less door for trouble to slip through.
• Named accounts let you see who did what, and remove access cleanly.

Connecting From Windows - the \\NAS Name

Once folders and users are set, people will want to reach those folders from their own computers - not just through the browser. On a Windows PC, this is done with a special address that starts with two backslashes.

Once connected, those NAS folders behave like any other folder on the PC - you can open, copy, and save files right into them. You can also map the NAS as a drive letter so it shows up automatically, which is a nice convenience for folders you use every day.

• Open File Explorer - the yellow folder icon on the taskbar.
• Click in the address bar at the top.
• Type two backslashes followed by your NAS name, like \\DiskStation.
• Press Enter, then sign in with a NAS user name and password when asked.
• The shared folders you are allowed to see will appear like normal folders.

Connecting From a Mac

Reaching your NAS folders from a Mac is just as doable, using the Finder's built-in "Connect to Server" feature. The idea is the same as on Windows - point the Mac at the NAS and sign in.

As on Windows, the folders then act like any other folder on the Mac. You can also make them reconnect automatically at startup, so your NAS is always waiting for you without repeating these steps each day.

• Click the desktop, then open the "Go" menu at the top of the screen.
• Choose "Connect to Server."
• Type the NAS address, often starting with smb:// followed by the NAS name.
• Click Connect, then sign in with a NAS user name and password.
• Pick the shared folders you want, and they open in a Finder window.

Setting a Quota So One Person Cannot Fill It

A NAS has only so much room. A quota is a size limit you can place on a person or a folder, so one enthusiastic photo-taker or one runaway backup does not swallow all the space and leave everyone else stuck.

You can set a quota on a user account - capping how much that person can store overall - or on certain folders. When someone reaches their limit, they are simply asked to free up space before adding more. It is a gentle guardrail, not a punishment, and it keeps the NAS fair for everyone.

• Households where one person tends to store far more than the rest.
• Small businesses that want to keep space balanced across staff.
• Any NAS that is starting to fill up and needs a little discipline.

Advanced Permissions in Short

Beyond the simple read-only and read/write choices, DSM offers a more detailed set of controls, sometimes called advanced or fine-grained permissions. Most people never need them, but it helps to know they exist.

These advanced settings let you get very specific - for example, allowing someone to add files but not delete them, or to see a folder's contents but not open certain items. They are useful in businesses with careful rules, but they also add complexity and are easier to get tangled up in.

• For homes, the simple read-only and read/write choices are almost always enough.
• Reach for advanced permissions only when the simple ones truly cannot do the job.
• The more detailed the rules, the more careful you must be to track them.

Sharing a Folder or File With a Link

Sometimes you want to give one file or folder to someone who does not have a NAS account at all - like emailing a batch of photos to a relative. For this, DSM can create a sharing link, a simple web address that opens the item.

Using File Station or Synology Drive, you can right-click a file or folder and choose to share it, which produces a link you can send. The person clicks the link and can view or download what you shared, without needing to sign in to your NAS. It is the friendly way to hand something to an outsider.

• Set the link to expire after a while, so it does not stay open forever.
• Add a password to the link for anything the least bit private.
• Only share links for items you truly mean to send outside the household.

A Simple Permissions Plan for a Household

Let us pull it all together into a plan you could actually use at home. Nothing fancy - just a sensible arrangement of drawers and keys that keeps the right things shared and the private things private.

Notice the shape: one open drawer for shared life, a couple of grown-up drawers, a private drawer for the sensitive stuff, and everyone's own home folder for personal things. Set up a "Adults" group and a "Kids" group, and this whole plan takes only a little while to build.

What's in the 27-page PDF

• What a shared folder really is, in plain words
• How to make folders and add the people who use them
• The difference between read-only and full access - and how conflicts resolve
• Private Home folders, the recycle bin, and encryption
• Connecting from Windows and from a Mac
• Quotas, guest accounts, sharing links, and a simple household plan

Why I wrote this

I write these as printable handouts because a guide you can keep in a drawer beats a web page you have to find again. No jargon, no judgment, no rushing. If you'd rather have someone sit beside you and go through it together, that's a flat $99 first visit with the 30-day follow-up included — serving Portage County from Atwater, Ohio. — Bill