Synology NAS Domain Controller Complete Setup With Group Policy

A Synology NAS can work as a real domain controller using the free Synology Directory Server package from Package Center. Under the hood it is a Samba-based Active Directory domain controller: it speaks Kerberos, holds your user accounts and computers in one database, and enforces Group Policy on Windows PCs - the same daily jobs a Windows Server DC does in a small office.

What makes it attractive is what is missing: no Windows Server licence and no CALs (Client Access Licences). The package is free, the NAS you already own for files becomes the login server, and one account per person works for the PC, the shared folders and the other DSM services.

Do these checks first, because two of them are permanent:

1. Compatible model. Directory Server only installs on Synology's supported model list - generally the Plus series and above. Check your exact model on Synology's official applied-models page before planning anything.
2. DSM 7.1 or later and a fixed static IP for the NAS. A domain controller whose address changes is a broken office.
3. Final NAS hostname. Once Directory Server is activated, the NAS hostname cannot be changed. Name it properly now (for example NAS01), not later.
4. A domain name you will keep. Something like office.local - at least two parts, simple characters. It also cannot be the same as the NAS server name.

1. Open Package Center on the NAS, install Synology Directory Server. It works together with the DNS Server package, which the domain needs for name resolution - install it too if DSM asks.
2. Launch Directory Server and start the first-time setup wizard.
3. Enter the domain name (the workgroup/NetBIOS name fills in automatically), and set a strong password for the domain administrator account. Store this password in a password manager - it is the master key of the office.
4. Confirm and click Apply. DSM now creates the domain and promotes the NAS to a domain controller. Let it finish without interruption.

One side effect to know: after the domain is created, SMB signing is switched on automatically. That is a security feature, but it can slow large file copies slightly. Most offices leave it on.

A domain only works if PCs can find it, and PCs find it through DNS. Set the router's DHCP settings (or each PC manually) so the DNS server address is the NAS's IP. If a PC uses the router or a public DNS like 8.8.8.8 as its only DNS, it will never locate the domain - this one setting causes almost every failed domain join.

Test on one PC first: nslookup office.local should answer with the NAS's IP address.

Open Directory Server on the NAS and create your people: one account per real person, never shared accounts. Add groups that match how the office works - Accounts, Sales, Office Staff - and put people in groups. Later, file permissions and policies will target the groups, so a new joiner is set up by adding group memberships, not by rebuilding settings PC by PC.

Set the password policy while you are here: Directory Server supports password strength rules (length, expiry, history) and account lockout after repeated wrong passwords. Turn lockout on - it is your cheap defence against password guessing.

1. On the PC, confirm its DNS points to the NAS (step 4) and that the PC clock is correct - Kerberos refuses logins when clocks drift apart.
2. Go to Settings > System > About and choose Join a domain (or run sysdm.cpl and use the Computer Name tab).
3. Enter the domain name, then the domain administrator credentials when asked.
4. Restart the PC and log in with a domain user account.
5. Verify: run whoami - it should show the domain name before the username.

This is a genuine domain controller for small offices, not a 100% clone of Windows Server AD. Know the edges: it supports a single domain; the functional level equals Windows Server 2008 R2; the Active Directory PowerShell module is not supported; DFSR is not supported; and it cannot form trusts with a separate Windows Server domain. A second Synology can join as an extra controller, but only for a domain the Synology created. For a 5-30 person office that needs logins, policies and central accounts, none of this blocks the job - the separate pages in this series cover each limit honestly.