How do I deploy roaming profiles for Synology Directory Server's users?

How do I deploy roaming profiles for Synology Directory Server's users?

Purpose

This article guides you through using Synology Directory Server to assign roaming profiles1 to Windows client computers.

Notes:

    • Synology Directory Server is the updated version of Active Directory Server, not LDAP Server (formerly named Directory Server).

Resolution

Before you start

  1. Join a Windows PC to the domain (see chapter 4 of Synology Directory Server Administrator's Guide).
  2. Download and install RSAT (Windows Remote Server Administration Tools) on a domain-joined computer (see this article).

Assign a roaming profile for a single domain user

  1. Go to DSM Control Panel > Shared Folder to create a shared folder. Please note that shared folders for a single user and for all users should not be the same.
  2. Right-click the created shared folder and click Edit.
  3. At the Permissions tab, select Domain users.
  4. Tick the Custom checkbox, and the Permission Editor window will be displayed.
  5. Select a target from the User or group drop-down menu, and set Apply to and Permission by following the settings in the table below. The image below is an example of how to set permissions for a user-defined group named "Owner".
    User or group Apply to Permission
    User-defined group (e.g., "Owner") Select Child folders, Child files, and All descendants. Select Administration, Read, and Write for full control.
    Domain Admins Select all the options. Select Administration, Read, and Write for full control.
    Domain Users Select This folder. Select Read for full read permissions and only Create folders/Append data under Write.
  6. After setting up the shared folder, go to Synology Directory Server > Users & Computers > Users.
  7. Right-click a domain user account and click Edit.
  8. Switch to the Profile tab, enter a shared folder's path for the user's roaming profile in Profile path in the following format, and save the setting:
    \\IP address of NAS\shared folder name\%username%2
  9. Sign in to the domain-joined Windows PC with the specified domain user account. The domain controller will automatically create a corresponding roaming profile (the folder name will be "username.V6") in the remote shared folder on the NAS.

Assign roaming profiles for all domain users

  1. Follow steps 1 - 5 in the first section. Make sure you have created a shared folder and granted sufficient permissions to all domain users on the domain controller.
  2. Sign in to a domain-joined Windows PC as a domain administrator.
  3. Go to Windows Control Panel > System and Security > Administrative Tools > Group Policy Management.
  4. Go to Forest: domain name > Domains > Domain name > Default Domain Policy.
  5. At the Settings tab, right-click to open the context menu, and click Edit.
  6. Go to User Configuration > Policies > Windows Settings > Folder Redirection.
  7. Right-click the folders you would like to redirect and click Properties.
  8. Configure the settings as below:
    1. Switch to the Target tab.
    2. Select Basic - Redirect everyone's folders to the same location.
    3. Enter the information needed in Target folder location and Root Path.
    4. Click OK.
  9. The roaming profiles of domain users will be directed to the path you assigned.

Notes:

  1. Roaming profiles allows domain users to have a consistent user experience when working on different domain-joined computers. Users can access their own files even if they sign in to different computers.
  2. Please do not modify "%username%", the environment variable that automatically points to the profile folder of the specified user.
Purpose
Contents
Resolution
Before you start
Assign a roaming profile for a single domain user
Assign roaming profiles for all domain users