How do you set the permissions for shared folders on NAS? The whole family shares one machine, I create a separate account for each person, and no one ever accidentally deletes anything

the first year after installing my NAS, the whole family only had one admin account. Who even entered this password for the NAS? Until my dad found a movie on TV, and with a drag, he moved the entire photo folder of "Daughter 0 to 3 Years Old" into the "Movies" folder he created himself. The timeline used in the album instantly broke in two, and I spent more than half an hour flipping through it before I finally put everything back in place. That day, I decided: each person has one account, separate permissions. Half a year has passed since this incident, and the family hasn't lost any documents again.

first talk about my mistake: the whole family shares admin, which means everyone is an admin

What permission does

admin have? Full authority. It can delete any folder, change any settings, and see everyone's belongings. If you give admin to elderly or children, it's like stringing all the keys in the house together and hanging them at the door.

My dad wasn't the first to get into trouble. My wife previously downloaded TV dramas to save trouble by tossing everything into my work backup directory, mixing it with project files, and I had to pick them out one by one. Later, I wrote NAS the article about ransomware researching and saw a phrase about "permission minimization," which means not allowing every account to access all the files—the same principle applies to a home NAS. If ransomware can't be prevented, that's one thing, but if someone at home is careless, you really can't stop it.

another easily overlooked point: when something happens with a shared account, you don't even know who did it. All three devices at home are registered as admin, folders are gone, and no one admits it after asking around. After separating accounts, it's clear whose recycle bin belongs to and whose actions are in the logs.

Before

start, draw a table of contents: public area, private area, read-only area—three levels are enough

don't rush to open an account; first think carefully about the directory. Permissions follow the directory; if the directory is messy, permissions will be confused. My house only has three floors, which will last for several years:

The advantage of

three-layer is that once the permission matrix is configured, you don't need to change it again. Add new family members? Adding a line of accounts. Are the photos piling up more and more? Throw everything into the archive area, since the whole family only reads it. It's much easier to manage than when I first tiled four or five folders under "Movies," "Photos," "Work," and "Downloads"—that kind of structure means you have to rethink who and what permissions to give every new folder, which is annoying.

the photo section, there's a prerequisite step: first install auto backup on your phone, and all backed-up photos will be placed in one folder. Then, decide who can view them. In my article backing up phone photos to NAS I've written four options, so I won't repeat them here.

Synology: Create an account, set up a matrix, and if you want to move subfolders, enable advanced permissions

my Synology is a DS220+ with DSM 7.2. Two-step approach:

Step one: Create an account. Control Panel → User and Group → Create, name, set password, and then proceed to the next step. Make sure not to check anything on the permissions page; regular users are enough. Never assign admin groups to the elderly or children. Synology' first configuration article about system initialization, just continue here.

Step two: Pair with the matrix. Control Panel → Shared Folders → Select "Family Sharing" → Edit → Permissions tab. From the dropdown menu, switch from "Local Groups" to "Local Users," then check each one: I read/write, Wife read/write, Dad read-only, Child's tablet-only read-only. Repeat each shared folder by copying the sheet above.

here, there's a unique pitfall for Synology: this checkbox only goes to the shared folder layer. If you want "Dad can view photos in the same shared folder but not my work subfolders," you need to enable "Advanced Shared Folder Permissions" in Edit, which is the Windows ACL setup, then set each subfolder in File Station. Don't forget to check "Hide subfolders and files for users without permissions," otherwise if Dad sees the folder, it won't open and he'll think the machine is broken and come to ask you. As long as it's enough, that's enough. My family finds it troublesome, so we just put the items to be isolated into different shared folders, each folder with its own permissions, which is worry-free.

Feiniu setup here: personal space is free quarantine, shared space is via team folder

N100 the running Feiniu has a logic that's easier to understand than Synology: private is the default, shared is the exception.

Create an account: Open Control Panel on the desktop, → User Management, → Create User. The system will automatically assign each person a personal space. This space is completely invisible to others, you don't need to equip anything, and the isolation is free. Everyone's personal files go to their own homes, zero configuration.

shared items go through the "Team Folder": Log in to the administrator account, file management → team files→ create a new team folder. When creating, check both members and permissions together. Read-only, read/write, and access denial, copy according to the matrix. From now on, if you want to temporarily share a file from your personal space with someone else, just right-click to share. The other person will see it in the file management section under "Others Sharing," so you don't have to move it around.

personal or team files, to connect a second hard drive to create a shared directory. When creating a shared directory note that after creating a new directory, it still defaults to no permissions. Remember to add people in the team folder, or else the whole family will complain about not connecting.

three ironclad rules that apply to both sides—remember to avoid falling into half the pitfall

the first point, rejection takes priority. Synology and Feiniu have the same permission priority: Disable access, overwrite read, write, and read only. If someone has read/write in the parent folder but is blocked in the subfolder, the result is that the subfolder cannot be accessed. Don't think it's a bug; it's design—Feiniu's official documentation clearly states that child denial privileges take precedence over any permissions inherited from the parent.

the second point: reading only is the root of deletion protection. My dad now only reads the photo section. If he wants to share photos, he saves a copy on his phone. If he wants to organize them, let me know. Many people think that opening the recycle bin means everything's fine, but that's not true. the article Synology Drive Sync Disk, I wrote that two-way sync infects deletion actions to every end, and read-only permission is a safety net that prevents even syncing from being deleted. The archive section is even for the whole family only; photos from seven years are placed inside, and anyone who comes can only see them.

Third, keep the recycle bin running as usual. In Synology's shared folder editing section, you check 'Enable Recycle Bin,' and Feiniu also has a Recycle Bin option in the shared directory settings. Read-only protects against slips, while the Recycle Bin prevents me, as an administrator, from deleting mistakes myself. These two safeguards don't conflict—anything deleted can be recovered within 90 days.

The last pitfall is on Windows: if SMB remembers admin when you first connect, it won't ask when someone else logs in later. Control Panel → Credential Manager → Windows Credentials. Delete the old entries; the next connection will ask for your account and password. On the day you set up permissions, have each device reconnect with your own account, so the old passwords you remember don't leave your matrix empty.

Finishing: Follow this sequence and you'll finish in half an hour

not every family is worth such a stir. If you use it alone, or both couples know how to keep things going, one account is more than enough. But as long as there are three or more people at home, elderly people and kids, and lots of photos and videos, that half hour is the most valuable half hour I've ever spent—permissions, you don't usually feel they exist, but you only realize they're valuable on the day of the accident.