The services are the easy half. The half that decides whether your file server stays clean is the people half — accounts, permissions, doors and quotas, set once and set properly.
A file server becomes real the day you stop sharing one admin password. Synology DSM gives you the full toolkit — one account per person, per-folder permissions, per-application doors and a disk quota — and the video walks through all of it. Here is how to set it up so it stays tidy a year later.
In Control Panel → User & Group → Create, make a separate DSM account for every human. It feels slower for ten minutes and saves you forever: when someone leaves, you disable one account; when a file vanishes, the logs name a person; when a quota fills, you know whose library it is. A shared office login destroys all three of those answers.
During creation (and later under Edit), DSM asks what each user may do in every shared folder: Read/Write, Read only, or No access. Think in jobs, not in trust: Accounts gets Read/Write on Accounts, Read only on Templates, No access on HR. Combined with the File Services option to hide folders a user has no permission for, people simply never see the rooms they cannot enter.
The same user edit screen has an Applications tab. This is the part most people skip and later regret: a user can be allowed SMB but denied FTP and SFTP, or the reverse. Give the internet-facing doors (SFTP, FTPS) only to the people who actually transfer files from outside. Everyone else loses nothing — their Windows shares keep working.
Once a team passes a handful of users, permissions per person turn into spaghetti. Create groups — Accounts, Design, Vendors — set the folder and application permissions on the group, and just drop people into groups. A new joiner is then a two-minute job, and a leaver is one removal.
Set a per-volume quota for each user, as the video demonstrates. A quota is not suspicion; it is physics. One user backing up an entire laptop, or syncing 800 GB of raw video, can fill a shared NAS overnight and break everyone else's work in the morning. Size it generously, warn at the panel when someone nears the top, and raise it on request — a raised quota is a conversation; a full disk is an emergency.
With User Home Service enabled (User & Group → Advanced), every account also gets a private home folder. Shared folders are for teams; the home folder is where personal work-in-progress belongs instead of being scattered across team shares. Admins can still see home folders — say so openly, so nobody stores truly private material there under a misunderstanding.
Creating the account, ticking the right permissions and setting the quota — shown live, click by click.
▶️ Watch Full VideoThey can, but it quietly breaks accountability: logs cannot tell them apart, a leaver forces a password change for everyone, and quota problems have no owner. Separate accounts take minutes and stay simpler forever.
Uploads to that volume start failing for that user until space is freed or the quota is raised. Other users are not affected — which is exactly the point of setting the fence before it is needed.
Yes. In the user settings, the Applications tab lets you allow or deny each service per user or per group. It is the cleanest way to limit who can reach the NAS through the internet-facing doors.