Most NAS permission pain comes from one shortcut: everybody using the admin login. This page sets up TrueNAS access the way that never generates lockout stories - one account per person, groups doing the heavy lifting, and a written-down recovery path for the day somebody forgets a password.
Permissions feel like paperwork until the day a deleted folder or a curious guest explains why they exist. The good news: on a home or small-office TrueNAS, the whole system fits on an index card - people get accounts, accounts join groups, groups get folders. Set it up once, in that order, and access questions answer themselves.
Example layout - small, readable, and every person can be found in it.
Create each user under Credentials → Users with their own password. Shared logins feel easier for exactly one week; then a file vanishes and nobody can say who was signed in, and one password change locks out the whole house. Individual accounts also mean access can be removed for one person - a guest, a departing employee - without disturbing everyone else.
Do not assign folders person by person. Make groups that match real life - family, kids, office, guests - put people in them, and give the group its permissions on each dataset. When a cousin visits or a new colleague joins, you change one membership instead of re-editing every folder. In TrueNAS these permissions live on the dataset under Permissions / ACL; pick a simple preset and adjust only what you must.
Some people genuinely only need to look: children with the photo library, a TV with the Media folder, an accountant with last year's documents. Give those accounts read-only access and whole categories of accident become impossible. Keep at least one folder - Backups - with no ordinary user access at all.
The admin login can do everything, including destroying the pool, so it is used only for managing the NAS - never as the account your PC maps drives with. Write its password down on paper, sealed and stored somewhere sensible offline. If it is ever forgotten, TrueNAS can be reset from the machine's own console with physical access - one more reason the box itself should sit somewhere reasonably private.
Every step shown live on screen - installation, pools, shares and the settings that matter.
▶️ Watch Full VideoYes - create a dataset for that person and set its permissions to only their account. It works well for personal scans and documents. Remember the admin can still see everything; on a home NAS that is normal and expected.
Disable or delete just their account. Their files stay - files belong to folders, not to the person - and every other login keeps working untouched. This is the quiet payoff of never sharing accounts.
Read-only access prevents it completely for that account. For shared writing areas, pair permissions with TrueNAS snapshots - then an accidental delete becomes a two-minute restore instead of a loss.