In DSM, one No access beats every Read/Write - that is why your user is locked out. Learn the deny-first rule and the group discipline that keeps Synology permissions clean.
Here is the Synology permission problem that confuses everyone once: you gave a user Read/Write, they still cannot open the folder, and DSM shows no error explaining why. The answer is almost always the same - somewhere, a group they belong to has No access, and in DSM, No access always wins. Once you understand that single rule, permissions stop being mysterious.
Example only - one No access anywhere cancels Read/Write everywhere. DSM checks deny first.
DSM combines every permission a person gets - directly, and through every group they sit in - and then applies a fixed order: No access beats Read/Write, which beats Read only. Two allows add up to the stronger allow. But a single No access anywhere cancels everything. This is a safety design: it is better to lock a door twice than to open the wrong one.
The classic setup: a wide group like everyone or users is set to No access on the salary folder to keep it private. Later, the accountant is added to accounts-team with Read/Write - and still cannot get in, because she is also in everyone, whose No access wins. Windows ACL settings on the same folder can narrow things further: Synology documents that when shared folder permissions and Windows ACL disagree, the access you finally get is only what both allow.
Read only is the right answer more often than people think - reference folders, price lists, archives, anything the team must see but never edit. Pair it with No access used sparingly and your permission table reads like a policy document: who can change, who can look, who stays out.
The full shared folder setup - creating folders, users and permissions - shown live on a Synology NAS.
▶️ Watch Full VideoThe deny wins. DSM applies No access with the highest priority, above Read/Write and Read only. Remove the user from the denying group, or remove the No access entry, and the allow will start working immediately.
For that group alone, the result looks the same - no entry means no permission from that group. The difference appears when the person is in several groups: an unticked group adds nothing, while a No access entry actively cancels permissions granted by their other groups.
Subfolders inside a shared folder follow Windows ACL-style permissions, which you can edit in File Station under Properties → Permission. The shared folder's own permission is the outer gate: nobody passes the gate without access there, no matter what the subfolder says.