<div style="text-align: center">Synology Directory Server Notes </div>

# <div style="text-align: center">Synology Directory Server Notes </div> References: [Administrator's Guide for Synology Directory Server](https://global.download.synology.com/download/Document/Software/AdminGuide/Package/DirectoryServerForWindowsDomain/All/enu/Syno_AdminGuide_SynologyDirectoryServer4_4_enu.pdf) #### I. Synology Directory Essentials <ol> <li>Directory Service</li> - A directory is a repository containing individual persons, groups, locations, and various types of information. It is a tool for data storage and management, allowing users to easily find the information they want to access. In computer science, a directory service stores all account information in a centralized location. <li>Active Directory & Synology Directory Service</li> - Active Directory (AD) is a type of directory service that offers a centralized database of information with which IT administrators can securely manage accounts and resources, such as computers and prints. Synology Directory Server provides the AD-based Synology Directory service, allowing you to store and deploy resources on an intuitive interface. <li>Domain Name System(DNS)</li> - Synology Directory service adopts the Domain Name System to organize computers, printers, or other resources into a hierarchical structure. - A domain is a logical boundary set up for the creation and management of resources, while DNS is a standard internet service that structures resources through domain names. In a domain (e.g., 'syno.local'), devices are delpoyed through DNS, which helps resolve their easily readable hostnames (e.g., 'pc1.syno.local') into IP addresses needed for locating and identifying devices with internet protocals. - With a high dependency on DNS, it is necessary to set up a DNS server to maintain the functionality of domain when installing Synology Directory Server. <li>Domain Controller</li> - A domain controller (DC) is a NAS that hosts a Synology Directory Server's domain. It is responsible for maintaining domain functionality, soring directory data, and managing user interactions within a domain. In Synology Directory Server, the Synology NAS where a domain is created will be automatically promoted as a domain controller. <li>Domain Object</li> - The domain database stored in Synology Directory Server is made up of information about objects, each of which represents a single and unique entry in the database. The following are the objects that can be managed in Synology Directory Server: <ul> <li>User: a User account that can access resources deployed in a domain</li> <li>Group a manageable unit used to gather domain objects. All memebers in a group share the same access permisions to files, folders, applications, or devices within a domain.</li> <li>Device: a physical resource that can be accessed by domain users. It can be a computer, a printer, a NAS, etc.</li> <li>Organizational Unit (OU): the smallest container in a domain to which administrative privileges and group policies can be assigned. You can put users, groups, computers in an OU for delegating the same authorities and policeis to them. Besides, you can also add an OU to another OU, creating an OU Hierarchy that corresponds with the real-world organization structure. In so doing, it will be more efficient to configure domain objects in Synology Directory Server.</li> </ul> <li>Compatability and limitations</li> <ul> <li>DSM Version requirment: DSM 6.2.2 or above</li> <li>Domain functional level: equal to Windows Server 2008</li> <li>Synology Directory Server must work with the DNS Server package</li> <li>Synology Directory Server is not compatible with configurations of other domain/LDAP services.</li> <li>Supported domain clients: Win7 or above, macOS, Linux</li> <li>Applied Synology NAS models: See on the Synology offical Website</li> <li>Limitations:</li> <ul> <li>Synology Directory Server supports a single domain and single domain controller only.</li> <li>The hostname of the Synology NAS that functions as the domain controller cannot be changed after Synology Directory Server is activated on it.</li> </ul> </ul> </ol> #### II. Install Synology Directory Server <ol> <li>Before installing **Synology Directory Server** on the Synology NAS, please check the following:</li> <ul> <li>The network connection of Synology NAS works properly.</li> <li>The volume of Synology NAS is working well.</li> <li>The DSM is updated to version 6.2.2 or above.</li> <li>You are the DSM admin (or a user belonging to the **administrators** group) of Synology NAS</li> <li>The Synology NAS is using a static IP address</li> - To avoid clients from being disconnected because of IP address changes of the Synology NAS (domain controller), you need to set up a static IP address on your local area network for Synology NAS. <li>The Synology NAS is not a client of any domain or LDAP directory</li> - If the synology NAS has already joined a domain or an LDAP directory, it must leave the domain or LDAP directory before using Synology Directory Server. This package is not compatiable with configurations of other directory services. <li>No domain name conflicts exist on the local area netowrk</li> - Synology Directory Server will not be found by clients if more than one domain has the same name on the local network. To avoid this issue. please choose another name or remove the domains that have the same name. </ul> <li>Sign into DSM as **admin** or a user belonging to the **administrators** group.</li> <li>Go to **Package Center > All Packages**.</li> <li>Click **Install* in the **Synology Directory Server** section and follow the onscreen instructions to complete the installation process.</li> </ol> #### III. Getting Started with Synology Directory Server Set up Synology Directory Service: Once the installation is complete and there are no existing domains detected, you can start setting up Synology Directory service. In the section below, we will see how to create a domain and promote the Synology NAS as a domain controller. <ol> <li>Launch Synology Directory Server.</li> <li>Click Next to continue with the setup.</li> <li>Enter the following information and click Next:</li> <ul> <li>Domain Name: Enter an FQDN (Fully Qualified Domain Name) for the domain, e.g. "syno.local".</li> <li>Workgroup: The workgroup name (or the NetBIOs domain name) will be automatically filled in this field. For instance, if your domain name is "syno.local", the default workgroup name will be "syno".</li> <li>Password: Enter a password for the administrator account of your domain.</li> <li>Confirm Password: Enter the password again.</li> </ul> <li>Confirm the settings and click Apply. The system will now create the domain and promote the Synology NAS to be a domain controller.</li> </ol> Manage the Domain: On the Status page, you can check, edit, or remove your domain and the domain controller. View Domain Information Information about your domain can be view at any time on the Status page: <ul> <li>Domain name: The full name of your domain</li> <li>Domain NetBIOS name: The short name for the domain, which will be used by earlier versions of Windows (e.g., Windows 95 or Windows 98) to access Synology Directory resources.</li> <li>Number of records which may need updates: If the number shown is 0, then all DNS resource records in DNS Server correctly point to the IP address of the Synology NAS (domain controller). If the number shown is bigger than 0, then resource records in DNS server require updating.</li> </ul> Remove the Domain On the Status page, click Remove Domain to remove the domain currently managed by Synology Directory Server. Please note that removed the domain is *irreversible*. Edit the IP Address of Domain Controller Synology Directory Server is normally set up with a static IP address. For certain reasons, you may need to change the IP address of the Synology NAS that is running Synology Directory Server. Please follow the steps below: <ol> <li>Back up Synology Directory with Hyper Backup</li> <li>Change the IP address of the Synology NAS</li> <li>Confirm and update the resource in DNS Server</li> <li>Restart Synology Directory Server to update the network settings. Please do the following:</li> <ul> <li>Go to Package Center > Installed > Synology Directory Server.</li> <li>Click the inverted triangle and select Stop</li> <li>After Synology Directory Server is stopped, click Run to restart the package</li> </ul> </ol> Manage DNS Resource Records Domain Name System (DNS) is a naming system that facilitates the exchange of data between computers over the Internet and other networks. It is mainly used to translate easy-to-memorize domain names (e.g., "pc1.syno.local") into corresponding IP addresses (e.g., "192.168.1.5"). This function is essential for the maintenance of Synology Directory Server's domain service. The following will guide you through A/AAAA record configurations and the DNS auto-registering mechanism. A/AAAA Resource Records A and AAAA are both DNS resource records for resolution between domain names and IP addresses. While A records translate domain names into 32-bit IPv4 addresses, AAAA records resolve domain names into 128-bit IPv6 addresses. DNS Auto Registering After a client has successfully joined the domain created by Synology Directory Server, the server will automatically register and update an A resource record (and an AAA resource record if IPv6 is enabled) to the DNS service on DSM, mapping the hostname of the client to an IP address. Limitations: <ul> <li>DNS auto registering cannot be disabled.</li> <li>Naming rules of domain clients: Only letters (a - z, A - Z), numbers (0 - 9) and hyphens (-) are allowed currently.</li> <li><srtrong>On Windows 7 or 10: Re-login or restart will be necessary if the hostname or IP address has been changed.</li> <li>On DSM or SRM: Re-login or restart will not be necessary if the hostname or IP address has been changed, and the resource records will not be updated.</li> </ul> Adjust A/AAAA Resource Records In order for Synology Directory Server to normally deliver services, all A/AAAA resource records in DNS Server must correctly point to the IP address of the Synology NAS. By default, all A/AAAA resource records will point to the IP address of the Synology NAS where a domain is created. However, A/AAAA resource records may not properly point to the Synology NAS due to the following circumstances: <ul> <li>The Synology NAS undergoes a change in its IP address after the domain has been created with Synology Directory Server.</li> <li>Synology Directory Server is restored through a backup task of Hyper Backup.</li> </ul> When encountering the cases mentioned above, please follow the steps below: <ol> <li>Go to DNS Server > Zones</li> <li>Select the specific DNS zone in question such as "domain name"@Active Directory or msdcs.domain name@Active Directory, and click Edit > Resource record.</li> </ol> Add Firewall Rules to Secure Directory Service Security is always one of the greatest concerns for Synology Directory administrators besides efficient management. To protect Synology Directory service, we suggest adding the following firewall rule to your Synology Directory Server: <ol> <li>Go to Control Panel > Security > Firewall.</li> <li>Tick the Enable Firewall checkbox.</li> <li>Under the Firewall Profile section, select a firewall profile from the drop-down menu and click Edit Rules on the right.</li> <li>Click Create.</li> <li>Under the Ports section, choose Select from a list of built-in applications and click Select.</li> <li>Select DNS Server, Synology Directory Server, and WIndows File Server. Click OK to confirm your selection.</li> <li>Under the Source IP section, choose Specific IP and click Select.</li> <li>Specify the local area network where Synology Directory Server is running by entering an IP address or an IP range. Click OK after you confirm the information.</li> <li>Under the Action section, select Allow to allow access by the ports and IP addresses you have specified.</li> <li>Click OK to save the settings.</li> </ol> #### IV. Manage OUs, Groups, Users, Computers #### V. Join Devices to a Domain #### VI. Configure Group Policies #### VII. Maintain and Recover Directory Service #### VIII. Troubleshooting and FAQs