Most people set up a NAS shared folder once, click through the wizard, and never look at it again. That is how you end up with a media library that stutters when two people stream at once, a backup folder that silently corrupts files after a power cut, or a photo share that Windows refuses to write to because of a permissions mismatch. The fix is rarely buying faster hardware — it is choosing the right combination of SMB version, caching behavior, and permission model for what the folder actually does.
This guide prioritizes four things, in order: smb.conf-level correctness first (protocol version and oplocks, because these cause data corruption when wrong), permission sanity second (a wrong ACL is the number one cause of “access denied” mystery errors), throughput tuning third (async I/O and socket options, which only matter once the first two are right), and convenience features last (recycle bins, time machine, media indexing) because each one adds a failure mode. If you are tuning for gaming-adjacent workloads — local game libraries streamed over LAN, or a scratch drive for captured footage — latency and locking behavior matter more than raw megabytes per second.
Quick Recommended Settings
| Setting | Recommended value | Why |
|---|---|---|
| SMB protocol minimum | SMB2, with SMB3 enabled | SMB1 is insecure and slow; SMB3 adds multichannel and encryption. |
| Oplocks / SMB leases | Enabled (default) | Disabling them forces clients to re-read files constantly; only disable for specific database folders. |
| Case sensitivity | Case-insensitive | Windows and macOS clients expect it; mixed-case duplicates cause sync conflicts. |
| Async I/O | Enabled, read/write (on Synology: “Enable asynchronous I/O” in the shared folder’s edit dialog) | Allows overlapping disk operations; noticeable with many concurrent small reads. |
| Recycle bin | Enabled on user shares, disabled on backup-target shares | Backups delete thousands of files per run; a recycle bin on those shares fills your volume fast. |
| Data checksums (Btrfs) | Enabled for media and document shares | Detects silent bit rot; the point of buying a NAS in the first place. |
| Access order | Restrict group first, then allow specific users | “Deny everyone, then allow” is far safer than “allow everyone, then patch holes.” |
| SMB encryption | Auto (encrypt sensitive shares, leave media shares plaintext on trusted LANs) | Encryption costs CPU; media streaming on a 1 GbE LAN rarely needs it. |
Setting-by-Setting
SMB Protocol Version (SMB2/SMB3 minimum)
Set it to: Maximum SMB protocol SMB3, minimum SMB2. On Synology: Control Panel → File Services → SMB → Advanced Settings → Maximum/Minimum SMB protocol. On TrueNAS SCALE: System Settings → Services → SMB → edit → Auxiliary Parameters, or per-share under Shares → SMB. On Unraid: Settings → SMB → “Enable SMB Multichannel” and the protocol minimum in smb extras.
Trade-off: Setting the minimum to SMB2 breaks ancient clients — some older smart TVs, NAS-attached printers, and first-gen media players only speak SMB1. If you have one of those, the better answer is a dedicated SMB1-only share for the dumb device rather than lowering the server-wide minimum.
Oplocks and SMB Leases
Set it to: Enabled (this is the default in DSM, TrueNAS, and Unraid). In raw smb.conf this is oplocks = yes, which maps to SMB2/3 leases on modern clients.
Trade-off: Oplocks let a client cache a file locally, which is why opening a large game archive or texture pack the second time feels instant. But if an application writes a database file from two machines at once (SQLite is the classic offender), oplocks can produce corruption. If you host a SQLite database or an Access file on a share, either move it off the share or set oplocks = no and veto oplock files = /*.db/*.sqlite/ for that one share only. Leave everything else with oplocks on.
Case Sensitivity
Set it to: Case-insensitive. On Synology this is fixed per filesystem behavior; on TrueNAS, Shares → SMB → Advanced Options → Case Sensitivity → “Default.” In smb.conf, case sensitive = yes is the setting to avoid for mixed-client homes.
Trade-off: Case-sensitive shares let Linux clients store “Save.txt” and “save.txt” as separate files — which then appear as one conflicting file to every Windows and macOS client. Unless every client on your network is Linux, keep it insensitive.
Async I/O and Socket Options
Set it to: Asynchronous read and write enabled. On Synology, this appears in Shared Folder → Edit → Enable asynchronous I/O. On TrueNAS, leave the defaults; the modern Samba defaults are already well-tuned and the old advice to paste socket options = TCP_NODELAY SO_RCVBUF=... lines is largely obsolete for SMB3.
Trade-off: Async I/O improves responsiveness under concurrent load (two people browsing different folders) but on very weak ARM CPUs can add latency to a single large transfer. If your NAS has less than 1 GB of RAM, test both.
Recycle Bin (Synology: “Enable Recycle Bin”)
Set it to: Enabled on personal and document shares; explicitly disabled on shares that serve as backup targets (Hyper Backup, Veeam, Time Machine destinations). On Synology the toggle is in Shared Folder → Edit; note the separate checkbox “Hide recycle bin folder from users” and that the bin is bypassed entirely for SFTP and File Station deletes — it only catches SMB deletions.
Trade-off: Recycle bins consume volume space and are invisible to users who wonder why their quota looks wrong. Schedule automatic emptying (Control Panel → Shared Folder → Recycle Bin → schedule, e.g. delete files older than 30 days).
Permissions: Group-First Model
Set it to: Create one group per access role (e.g. “media-ro”, “media-rw”, “family”), grant the group at the filesystem level (DSM: Edit Permissions; TrueNAS: Datasets → Permissions → Edit ACL), then add users to groups. Never grant permissions to individual users at the share level, and never use “Everyone” with a password as your security model.
Trade-off: Group management is a few extra minutes up front. The payoff is that “why can’t Sarah write to this folder” becomes a two-click diagnosis instead of an ACL archaeology project. Also enable “Apply permissions to this folder, sub-folders and files” once after fixing a mess, then turn inheritance back on so future files behave.
Data Checksums and Compression (Btrfs)
Set it to: Btrfs filesystem with checksums on (default) for document and photo shares; transparent compression is worth enabling for backup shares. DSM creates Btrfs shares by default on plus models; TrueNAS uses ZFS datasets, which checksum by default and cannot be turned off — that is a feature.
Trade-off: Checksums cost a little CPU on every write. Compression (Synology: per-volume setting; ZFS: zfs set compression=lz4 poolname/dataset) trades CPU for space — excellent for text-heavy backups, negligible benefit for already-compressed video.
By Hardware Tier
Low tier (ARM NAS, 512 MB–1 GB RAM, e.g. DS120j-class)
Disable SMB encryption entirely (Control Panel → File Services → SMB → Advanced → uncheck encryption), disable async I/O if large single-file transfers feel sluggish, and keep shares on a single volume rather than a volume with heavy snapshots. Do not enable compression. Expect roughly 40–60% of what a x86 box does on the same network — plan around sequential access, not concurrency.
Mid tier (x86 NAS, Celeron/N100-class, 4–8 GB RAM)
This is the sweet spot where every recommendation in the table above applies. Enable SMB3, enable multichannel if you have dual 1 GbE (Synology: Network → Network Interface → Enable SMB Multichannel; TrueNAS: it is a service-level toggle), enable Btrfs checksums and snapshots on document shares, and enable encryption on the share that holds tax documents and scans. One caveat: multichannel needs both NICs on the same switch or LACP-free separate links — do not combine multichannel and Link Aggregation; pick one.
High tier (Ryzen/EPYC/Xeon, 16 GB+ RAM, 2.5/10 GbE)
Enable SMB multichannel across your 2.5/10 GbE links, and make sure Jumbo Frames match end to end (MTU 9000 on the NAS interface, the switch, and the client NIC — a mismatch silently halves throughput). Enable per-share snapshots with a schedule (e.g. every 4 hours, keep 48) so ransomware or an accidental format is recoverable to a point in time. Leave SMB signing/encryption on “auto” so sensitive shares negotiate it while bulk media streams unencrypted. Consider aio max threads adjustments in smb.conf only if you have measured a problem — at this tier the defaults are rarely the bottleneck.
Common Mistakes
Access denied after moving a folder
What causes it: Files were copied via SSH/SFTP as root or by an internal service, so ownership no longer matches the share’s ACL.
How to check: SSH in and run ls -la /volume1/sharename/folder — look for owners like root:root where other files show your user or group.
What to do: chown -R user:group /volume1/sharename/folder, or in DSM right-click the folder in File Station → Properties → Permissions → apply to sub-folders. In TrueNAS use Datasets → Permissions → recursive chown.
How to undo: Restore the original owner recorded in your check output (note it before changing anything).
“You need permission” despite correct share permissions
What causes it: The Windows credential manager is caching an old login. Windows caches one set of credentials per server, so a saved password from months ago blocks the new one.
How to check: Open Credential Manager (Control Panel → User Accounts → Credential Manager → Windows Credentials), look for your NAS’s hostname or IP under “Generic” or “Windows credentials.”
What to do: Remove the stale entry, then run net use \\NAS-IP /delete in Command Prompt to drop live sessions, and reconnect.
How to undo: Re-add the credentials you removed if they were actually correct — the error will return immediately if they were, confirming the real problem is elsewhere.
Folder shows as empty on one client only
What causes it: Hidden-file convention mismatch — macOS-created ._ AppleDouble files and .DS_Store clutter, or the NAS’s hidden-file filter.
How to check: View the same folder via File Station or SSH; if files appear there but not in Explorer/Finder, it is a client visibility issue. Toggle hidden files (Windows: View → Show → Hidden items).
What to do: On Synology enable “Hide files starting with a dot” per share if the clutter bothers you; on macOS run defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool true to stop DS_Store creation on network shares.
How to undo: Run the defaults write command again with false.
Transfers stall after a few gigabytes
What causes it: Usually a write cache exhausting itself — the volume filled, the drive is SMR and collapses under sustained writes, or snapshots are consuming the free space snapshot creation needs.
How to check: Watch volume free space in Storage Manager during a copy; check whether your drives are on an SMR list (look up the exact model number); check snapshot reserved space.
What to do: Free at least 10–15% of the volume, delete stale snapshots, and for ongoing large writes to an SMR drive, limit concurrent writes to one stream.
How to undo: None needed — these are corrective, not experimental, changes.
FAQ
Should I use SMB, NFS, or iSCSI for my shares?
SMB for anything Windows or macOS touches, and for general mixed-client homes. NFS is the right choice for Linux-to-Linux, media server backends (Plex and Jellyfin both run well off NFS mounts), and VM storage, with lower overhead than SMB. iSCSI presents a raw block device — one machine at a time, no file-level sharing — so it suits a dedicated game library drive or a DVR scratch disk, not a family share. Run NFS and SMB side by side on the same folder if both client types need it; just be careful that UIDs match between systems or permissions will fight.
Do guest access and “Everyone” permissions really matter on a home LAN?
Yes, more than they used to. Any IoT device, compromised laptop, or guest Wi-Fi client that can reach the NAS inherits whatever “Everyone” allows, and ransomware strains specifically enumerate writable SMB shares. Set the guest account to disabled (Synology: File Services → SMB → uncheck guest access; TrueNAS: the guest option in the SMB service is off by default) and use named accounts even at home. It costs one password manager entry.
Will these settings survive a DSM or TrueNAS upgrade?
Core per-share settings (permissions, recycle bin, checksums) survive upgrades and are preserved in the share configuration database. Custom smb.conf extras do not always migrate cleanly — on Synology, hand edits belong in /usr/local/etc/smb.conf.local or via the “Advanced Settings” field, not the main smb.conf, and you should copy that file somewhere safe before a major version jump. After any upgrade, spot-check one share’s permissions and confirm clients can still authenticate before trusting the rest.
How many shares should I actually create?
Fewer, role-based shares beat many per-project folders. A practical starting layout: media (read-only for most users), documents (per-user subfolders with private permissions), photos, backups (hidden from general browsing), and scratch (open read-write, no snapshots, no recycle bin — for temp files and downloads). Six shares with clean groups are far easier to audit than thirty with tangled individual ACLs, and if you reorganize in 2026 or later, a role-based structure means changing group membership instead of rewriting every share’s permission table.
