Domains turn messy for one reason: structure invented later, person by person. Spend twenty minutes on this starter layout on day one and the domain stays clean for years.
The Synology will happily hold any structure - including a tangled one. The layout below is the one that survives growth in small offices: departments as organisational units, security groups that mirror them, and three account rules that never bend. It fits in Directory Server exactly as it does in Windows AD, because the concepts are the same.
Create an organisational unit for each real department - Accounts, Sales, Office, Warehouse - plus one for Computers if you want machine policies separated. Resist OU pyramids (department > team > shift): every level is a place for a policy to surprise you. Flat and obvious wins. OUs exist to aim Group Policies; if a policy would never differ between two groups of people, they do not need separate OUs.
For each OU, make a matching security group and put the same people in it. Then grant file and share permissions to the group, never to a person. The day someone moves from Sales to Accounts, you change two memberships and their access is exactly right - no archaeology through folder ACLs. Add one All-Staff group containing everyone for genuinely shared resources. On the Synology this group logic also drives DSM share permissions, so one habit covers both worlds.
One account per real person, named consistently (first name, or first initial + surname - pick one pattern on day one). Never create accounts like reception-pc or share one login across a shift. Shared accounts destroy accountability - when the shared account deletes a folder, nobody did it. A person who genuinely works at three desks still has one account; the domain is what makes that portable.
The domain administrator password is the master key, so it must not be anyone's daily login. Keep the built-in administrator for setup and emergencies, and give the IT person (or owner) a named admin account used only for admin work, separate from their normal account. Daily browsing and email happen on the normal account. This single habit is the cheapest real security upgrade in the whole project.
Joiner: create the account in the right OU, add the matching groups, done - policies and permissions follow automatically. Mover: change OU and groups; access updates at next login. Leaver: disable the account the same day - do not delete it immediately; disable first, keep for a few weeks in case files or ownership need untangling, then delete. And when you delete and later re-create a same-named account, Windows treats it as a stranger - that is another reason disable comes before delete.
The video builds users and groups on the live domain - watch it once, then lay out your own departments with this structure in mind.
Watch Full VideoUsually three to five: one per department that receives different policies, plus possibly one for computers. If two departments get identical policies and access, they can share an OU - structure should follow real differences, not the org chart's vanity.
Groups, always. Permissions granted to a person become invisible history; permissions granted to a group are a readable list. With groups, a staff move is a two-minute membership change instead of a folder-by-folder permission hunt.
Disable immediately, delete later. Disabling blocks logins the same minute while preserving the account in case their files, email ownership or audit trail need attention. Delete after a few weeks once a manager confirms nothing is still attached to it.