Frequently Asked Question
How do I set Synology shared-folder permissions and resolve an unexpected Access Denied?
QUICK ANSWER
Check the effective permission of the actual user, including group membership and any file-level restriction. A Read/Write tick in one place may be overridden by a No access entry elsewhere.
Applies to: DSM shared-folder access for local/domain accounts. Application permissions, Windows ACLs and NFS rules are separate checks.
Work through these checks
- Confirm the account and protocol. Identify which account the client actually uses and whether the connection is SMB, File Station, Drive or another service. A saved Windows credential can make a test use the wrong account.
- Set the intended shared-folder access. In Control Panel > Shared Folder, select the folder and open Edit > Permissions. Choose the relevant local/domain users or groups and grant only the required access.
- Review every relevant group. Check the user's group memberships and conflicting entries. Synology documents No access taking priority over Read/Write and Read only at the shared-folder permission level.
- Check the next permission layer. If the share permits access but a subfolder fails, inspect its inherited/custom ACLs. Also review application permissions and Advanced Shared Folder Permissions where used. Do not overwrite a complete folder tree's security to fix one item.
- Test as the intended user. Use an ordinary test account or the user's authorised session. Confirm listing, reading and, where required, creating a harmless test file. An administrator's result is not a substitute for the user's effective access.
- Keep other protocols separate. If the same data is accessed through NFS or a Drive team folder, check that service's rules as well as the shared-folder permission.
Confirm the result
The intended user can perform the required operation and a user who should be denied remains denied. Record which permission change produced that result.
Before going further: Do not grant Everyone or all users full control, enable the built-in administrator or remove inherited ACLs broadly as a first test.
If you need help
Include these details in your ticket: DSM version, account type, protocol, affected operation and a redacted permission/group summary. Never send passwords.
Related guidance: Windows error 1219 appears when I map a second Synology share. How can I reconnect? · File sharing: How to access files on Synology NAS within the local network (NFS)?
Updated 261110