Make Domain Controller FREE 😳 Synology NAS + Group Policy Setup!

Know What You Are Building

A Synology NAS can work as a real domain controller using the free Synology Directory Server package from Package Center. Under the hood it is a Samba-based Active Directory domain controller: it speaks Kerberos, holds your user accounts and computers in one database, and enforces Group Policy on Windows PCs — the same daily jobs a Windows Server domain controller does in a small office.

What makes it attractive is what is missing: no Windows Server licence and no CALs (Client Access Licences). The package is free, the NAS you already own for files becomes the login server, and one account per person works for the PC, the shared folders and the other DSM services.

Prepare the NAS Before You Start

Do these checks first, because two of them are permanent. Compatible model: Directory Server only installs on Synology's supported model list — generally the Plus series and above — so check your exact model on Synology's official applied-models page before planning anything. DSM 7.1 or later and a fixed static IP for the NAS: a domain controller whose address changes is a broken office.

Next, the final NAS hostname — once Directory Server is activated, the NAS hostname cannot be changed, so name it properly now (for example NAS01), not later. And pick a domain name you will keep, something like office.local: at least two parts, simple characters, and it cannot be the same as the NAS server name.

Install Directory Server and Create the Domain

Open Package Center on the NAS and install Synology Directory Server. It works together with the DNS Server package, which the domain needs for name resolution — install that too if DSM asks. Then launch Directory Server and start the first-time setup wizard.

Enter the domain name (the workgroup / NetBIOS name fills in automatically — for office.local it becomes OFFICE), and set a strong password for the domain administrator account. Store this password in a password manager — it is the master key of the office. Confirm and click Apply: DSM now creates the domain and promotes the NAS to a domain controller. Let it finish without interruption.

Point DNS at the NAS and Test It

A domain only works if PCs can find it, and PCs find it through DNS. Set the router's DHCP settings (or each PC manually) so the DNS server address is the NAS's IP. Test on one PC first — this command should answer with the NAS's IP address:

nslookup office.local

Create Users, Groups and Password Policy

Open Directory Server on the NAS and create your people: one account per real person, never shared accounts. Add groups that match how the office works — Accounts, Sales, Office Staff — and put people in groups. Later, file permissions and policies will target the groups, so a new joiner is set up by adding group memberships, not by rebuilding settings PC by PC.

Set the password policy while you are here: Directory Server supports password strength rules (length, expiry, history) and account lockout after repeated wrong passwords. Turn lockout on — it is your cheap defence against password guessing.

Join the Windows PC to the Domain

On the PC, confirm its DNS points to the NAS (Step 4) and that the PC clock is correct — Kerberos refuses logins when clocks drift apart. Open System Properties with the Run dialog (Win + R):

sysdm.cpl

Use the Computer Name tab → Change, select Domain and enter office.local, then give the domain administrator credentials when asked. (The same join is available under Settings → System → About → Join a domain.) Restart the PC and log in with a domain user account, then verify the login in Command Prompt:

whoami

It should show the domain name before the username — for example office\anshu — which confirms the PC is on the domain and you are signed in with a domain account.

Set Your First Group Policy with RSAT

There is no Group Policy editor inside DSM — by design, you manage policies the proper Windows way, with RSAT (Remote Server Administration Tools) on a domain-joined Windows 10/11 Pro PC. Install it from Settings → Apps → Optional features → Add a feature: add RSAT: Group Policy Management Tools and RSAT: Active Directory Domain Services tools. Then open Group Policy Management:

gpmc.msc

It connects to your Synology domain automatically when the PC is domain-joined. Create a first harmless policy — a mapped network drive to the NAS share, or a standard desktop wallpaper — link it to your users, then apply it on a test PC right away:

gpupdate /force

Confirm the policy applied. Drive mapping, folder redirection and roaming profiles all work through these policies — that is exactly what the video demonstrates end to end.

Know the Honest Limits

This is a genuine domain controller for small offices, not a 100% clone of Windows Server Active Directory. Know the edges: it supports a single domain; the functional level equals Windows Server 2008 R2; the Active Directory PowerShell module is not supported; DFSR is not supported; and it cannot form trusts with a separate Windows Server domain. A second Synology can join as an extra controller, but only for a domain the Synology created.

For a 5–30 person office that needs logins, policies and central accounts, none of this blocks the job — and you skipped the Windows Server licence and the CALs entirely.