The Synology holds the policies; a Windows PC edits them. RSAT's Group Policy Management Console is the bridge - here is the complete working routine.
New Synology domain admins often hunt DSM for a Group Policy editor that does not exist. That is by design, and it is good news: policies are real Microsoft GPOs, managed with Microsoft's own free RSAT tools from any domain-joined Windows Pro PC. This page covers installing RSAT, connecting to the Synology domain, and the first three policies worth pushing.
Use a domain-joined Windows 10/11 Pro PC (RSAT is not for Home editions). Go to Settings > Apps > Optional features > Add an optional feature, search RSAT, and install two items: RSAT: Group Policy Management Tools and RSAT: Active Directory Domain Services and Lightweight Directory Services Tools. On older Windows 10 builds RSAT came as a separate download - on current builds it is built into Optional features. Log in with a domain administrator account when you manage policies.
Press Win + R and run gpmc.msc. Because the PC is joined to the Synology domain, the console opens already connected to it - the forest and domain you see are the Synology's. Expand the domain to see your organisational units and the Default Domain Policy. If the console shows a different forest or an error, the PC's DNS is not pointing at the NAS; fix DNS first, exactly as in the domain-join steps.
The classic first policy: right-click your users' OU, choose Create a GPO in this domain, and Link it here, name it plainly (for example Map Office Drive), then edit it: User Configuration > Preferences > Windows Settings > Drive Maps - create a mapped drive to the NAS share with a fixed letter. Preferences like this are forgiving and immediately visible, which makes them the perfect proof that your policy pipeline works.
Next, the two policies small offices feel daily: a standard desktop (wallpaper and basic restrictions under User Configuration > Administrative Templates) so every PC behaves the same, and folder redirection for Documents and Desktop to a share on the NAS, so staff files live on the backed-up server instead of scattered PC disks. Add policies one at a time, test on one PC with gpupdate /force, then widen the link. gpresult /r on the PC shows exactly which policies applied - use it before you declare a policy broken.
Three honest notes. First, some account flags behave best when set in DSM - the known example is user must change password at next logon, which administrators report can error when set from the Windows ADUC tool; set it on the NAS instead. Second, there is no Active Directory PowerShell module support, so manage through the consoles, not scripts. Third, new ADMX templates (for newer Windows versions) can be added to the domain's SYSVOL policy store the same way as on Windows Server - the mechanism is standard, only the building is smaller.
The video's Group Policy section uses this exact RSAT route - watch a policy go from creation to a live PC before you build your own set.
Watch Full VideoBecause Synology Directory Server stores standard Microsoft GPOs and expects them to be managed with Microsoft's tools. RSAT on a Windows PC is the intended editor - it is free, familiar to any Windows admin, and it means policies behave identically to a Windows Server domain.
DNS, in almost every case. The management PC must use the Synology NAS as its DNS server and be domain-joined. Run nslookup for your domain name - it must resolve to the NAS - then reopen gpmc.msc.
It is far simpler from a joined PC, where your login and the console's connection just work. Standardise on one joined admin PC for all RSAT work - it doubles as your documented management station.