• Supports up to 16,000 local users and 512 local groups.
• The recommended number of users and groups may vary by Synology NAS model.
• Username length: Up to 64 Unicode characters.
• Group name length: Up to 32 Unicode characters.
• User or group description length: Up to 64 Unicode characters.

• Password length: Up to 127 Unicode characters.
• Custom password validity period: 1-999 days.
• Password change reminder: 1-99 days.

The following local accounts and groups are reserved and cannot be deleted.

• All users belong to the "users" group by default and cannot be removed from this group.
• The "admin" account has full privileges and can access all services and applications on Synology NAS.
• Users in the "administrators" group have unlimited volume and shared folder quotas.
• User names and group names cannot contain the following special characters: { } | ^ [ ] ? = : + / * ( ) $ ! " # % & ' , ; < > @ \ ~.
• User names and group names cannot begin with a hyphen (-) or a space, and cannot end with a space.
• Enabling Local Master Browser in SMB settings automatically enables the default "guest" account.

• Compatible with various directory servers, including:
  • Synology Directory Server
  • Microsoft Active Directory (Windows Server 2016, 2019, 2022)
  • Microsoft Entra Domain Services
  • Synology LDAP Server
  • Google LDAP Server
  • C2 Edge Server
• Supports Single-Sign-On (SSO)

• Allows setting and managing domain/LDAP user and group privileges
• Allows domain/LDAP users to access Synology packages and services
• Supports setting privileges for domain/LDAP users and groups to access shared folders and applications
• Supports quota settings for domain/LDAP users and groups
• Supports setting transfer rate limits for domain/LDAP users and groups when using FTP, rsync, File Station, and Cloud Sync
• Supports user home services for domain/LDAP users
• If a domain/LDAP client is joined to Synology Directory Server or LDAP Server, domain/LDAP users' passwords can be changed by clicking the head icon in the upper right corner of DSM
• A security group is required for domain users to access Synology services requiring file access permissions, such as Synology Drive, Synology Office, and SMB Service. For services without file access permissions, such as Synology Contacts or Synology MailPlus, either a distribution group or security group can be used

• Supports file access through the following protocols: SMB, FTP, AFP, NFS, and rsync
• Supports the following SMB authentication methods:
  • Domain clients: Kerberos v5 and NTLMv2
  • LDAP clients: NTLMv2; Kerberos v5 is supported starting from SMB Service 4.15.13-4209
• For LDAP users to authenticate with NTLMv2, the LDAP directory service must support the Samba schema and provide NTLM hashes

• Supports nested groups with up to 16 levels
• Supports Kerberos v5 and NTLMv2 authentication
• Supports two-way trusted domains
• Supports joining a domain with a read-only domain controller (RODC)
• Supports assigning up to 10 domain groups as local administrator groups
• Supports a combined total of up to 2 million users and groups per domain
• Supports Integrated Windows Authentication (IWA)
• Allows users in the "administrators" group to specify and prioritize the DC IP/FQDN
• Limitations
  • Does not support security identifier (SID) history
  • When using SSL/TLS for LDAP encryption, channel binding on Windows AD needs to be set to When supported
  • DC IP/FQDN does not support IPv6

• Supports OpenLDAP
• Supports LDAPv3 (RFC2251)
• Supports RFC2307 schema and custom LDAP filters and attributes
• Supports nested groups
• Supports SSL/TLS and STARTTLS encrypted connections
• Supports UID/GID shifting
• Supports verifying server certificates when joining a directory, except for C2 Identity Edge Server
• Limitations
  • LDAP user and group names can only use integers for their unique IDs
  • Does not support binding LDAP client accounts to a Synology Directory Server directory or other Active Directory (AD) domain services

• Natively integrates with Synology SSO Server
• Supports OpenID Connect (OIDC), SAML 2.0, CAS, and Synology SSO Service
• Supports OpenID Connect SSO in Microsoft Entra Domain Services and IBM WebSphere

• Domain/LDAP settings are included in system configuration backups and restores
• To restore server certificate verification settings for joining an LDAP directory service, both the exporting and importing systems should run DSM 7.3 or above

• Domain/LDAP users and groups do not support special characters: {}|^[]?=:+/*()$!"#%&',;<>@`~
• Does not support SSH for domain/LDAP users