DB-유

Setting Up SMB Shares on Synology for Windows and Mac

· synology, smb, windows, mac

SMB is the one job every Synology does, and the defaults mostly work. Mostly. Put Windows PCs and Macs in the same office and you meet the rest fast: Macs that won't see the server in Finder, Windows boxes connecting over SMB1 for no reason, Time Machine wanting its own quota, and permissions that behave differently depending on who created the folder.

These are the SMB settings I change on every new unit, how I structure folders and permissions, and what to do on each client. I assume DSM 6.1 or 6.2, a NAS on a fixed address, and local users and groups rather than a domain join.

SMB service settings

Control Panel → File Services → SMB/AFP/NFS. Under SMB tick "Enable SMB service", set the workgroup to match the Windows machines (usually WORKGROUP), then click Advanced Settings:

  • Maximum SMB protocol: SMB3.
  • Minimum SMB protocol: SMB2. This disables SMB1, which Windows 10 no longer installs by default and which no modern Mac needs. Only drop to SMB1 if you have an old printer or scanner that writes to the share.
  • Enable Opportunistic Locking: on. Enable SMB2 lease: on.
  • Enable Local Master Browser: off unless you still rely on Network Neighborhood browsing.
  • Enable Bonjour service discovery: on (under the AFP or Advanced tab depending on version). This is what makes the NAS appear in the Finder sidebar.
  • Transport encryption mode: Auto. Forcing encryption slows large transfers on small CPUs.

Also tick "Enable Windows network discovery" if present, which advertises the NAS via WS-Discovery so Windows 10 lists it under Network without SMB1.

Leave AFP disabled unless you have Macs older than macOS 10.9; Apple itself uses SMB now, and Time Machine works over SMB from DSM 6.1 on.

Groups and shared folders

Create groups before users: Control Panel → Group → Create, for example staff and finance. Then Control Panel → Shared Folder → Create:

  • Name: office. Location: the Btrfs volume.
  • Tick "Hide this shared folder in My Network Places" only for folders you do not want browsable.
  • Tick "Enable Recycle Bin" and "Restrict access to administrators only" for the recycle bin. This has saved more files than any snapshot schedule.
  • Under Advanced, enable shared folder quota if the volume is Btrfs.

Permissions tab: give staff Read/Write, and leave individual users alone. I stick to group permissions because groups make later changes a one-line job. For a finance share, give finance Read/Write and set staff to No access explicitly; No access wins over any Read/Write from another group.

Under Advanced Permissions on the same folder you can enable Windows ACLs for file-level permissions. I use them only where really needed; a folder tree where users set their own ACLs from Explorer becomes impossible to audit.

A Time Machine share for Macs

Create a shared folder timemachine with a quota, then Control Panel → File Services → Advanced → Time Machine → tick "Enable Time Machine broadcast via SMB" and select the folder. Give each Mac user a per-user quota under Control Panel → User → Edit → Quota so one laptop cannot fill the whole share. On the Mac, Time Machine's disk picker lists the folder directly.

Connecting the clients

Windows: map the drive with the NAS name or IP and DSM credentials, ticking "Connect using different credentials":

net use Z: \\nas01\office /user:nas01\jsmith /persistent:yes

The nas01\ prefix tells Windows the account is local to the NAS, not a domain or the local PC.

Mac: Finder → Go → Connect to Server → smb://nas01/office, log in as a registered user, and add the volume to Login Items so it remounts. If a Mac is slow browsing folders with many files, disable directory listing metadata on the client:

defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool true

This stops .DS_Store files being scattered over the shares.

Checking who connected how

From the NAS check which protocol version each client negotiated:

sudo smbstatus

The output lists connected users, machines and the protocol (SMB3_11 for Windows 10 and current macOS). Anything showing NT1 is an SMB1 client you thought you did not have. Copy a large file from a Windows client and watch Resource Monitor → Network on the NAS; a gigabit link should sustain 100 MB/s or more.

Common complaints

  • Windows: "You can't access this shared folder because your organization's security policies block unauthenticated guest access": the client tried a guest connection. Either give the user a real account or supply credentials explicitly with net use. Do not enable insecure guest logons in Group Policy.
  • Windows: "The specified network name is no longer available" or "Windows cannot access \nas01" only when using the name: NetBIOS resolution is failing because SMB1 and the master browser are off. Use the IP, add a DNS entry on the router, or enable WS-Discovery.
  • Mac: "There was a problem connecting to the server" while the IP works: Bonjour is disabled or the Mac is on a different VLAN, so mDNS does not cross. Connect by IP or DNS name.
  • Users can see a folder but get "Access denied" on files created by a colleague: Windows ACLs on the folder are inconsistent. Shared Folder → Edit → Permissions → re-apply with "Apply to this folder, sub-folders and files" ticked.

SMB1 off, groups instead of per-user permissions, recycle bin on. That's about all I do, and it's rarely the source of a support call.