Synology utilities for managing local users and groups
synouser and synogroup manage local, domain, and LDAP users and groups on Synology DSM. Use them instead of standard Linux useradd/groupadd commands, which bypass the Synology user database.
synouser --enum local
synouser --get USERNAME
synouser --getuid UID
synouser --add USERNAME PASSWORD "Full Name" EXPIRED MAIL PRIVILEGE
EXPIRED: 0 = active, 1 = expired/disabledMAIL: email address or empty string ""PRIVILEGE: privilege level (typically 0)Example:
synouser --add myuser 'P@ssw0rd' "My User" 0 "" 0
synouser --modify USERNAME "Full Name" EXPIRED MAIL
synouser --setpw USERNAME NEWPASSWORD
synouser --rename OLD_USERNAME NEW_USERNAME
synouser --del USERNAME1 USERNAME2 ...
synouser --rebuild all
Use
--rebuildafter making changes outside of DSM, or to sync domain/LDAP users.
| Command | Description |
|---|---|
--enum {local|domain|ldap|all|domain_used} | List users by source |
--enumpre {local|domain|all|domain_used} PREFIX CASELESS | List users with a name prefix |
--enumsub {local|domain|all|domain_used} SUBSTR CASELESS | List users with a name substring |
--enum_admin {local|domain|ldap|all} | List admin users |
--get USERNAME | Show details for a user |
--getuid UID | Look up user by UID |
--add USERNAME PWD "FULL NAME" EXPIRED MAIL PRIVILEGE | Create a new local user |
--modify USERNAME "FULL NAME" EXPIRED MAIL | Update user details |
--rename OLD NEW | Rename a user |
--setpw USERNAME NEWPASSWD | Set a user's password |
--del USERNAME... | Delete one or more users |
--login USERNAME PWD | Test credentials |
--rebuild {all|(domain FORCE)|(ldap FORCE)} | Rebuild the user database |
--create_homes {domain|ldap} | Create home directories for domain/LDAP users |
--revoke_password_pending USERNAME | Clear a pending password-change requirement |
--filesetpw | Apply password changes from a file |
--get Output FieldsUser Name : [username]
User Type : [AUTH_LOCAL]
User uid : [1024]
Primary gid : [100]
Fullname : [Display Name]
User Dir : [/var/services/homes/username]
User Shell : [/bin/sh]
Expired : [false]
User Mail : [[email protected]]
Alloc Size : [0]
Member Of : [N]
(gid) groupname
...
synouser only manages user accounts. Use synogroup (below) to manage group membership./var/services/homes/.--login command can be used to validate credentials without actually logging in.synogroup manages local, domain, and LDAP groups on Synology DSM. Use it alongside synouser when assigning users to groups.
synogroup --enum local
synogroup --get GROUPNAME
synogroup --getgid GID
synogroup --add GROUPNAME USERNAME1 USERNAME2 ...
synogroup --memberadd GROUPNAME USERNAME
synogroup --member GROUPNAME USERNAME1 USERNAME2 ...
This replaces the entire member list. To add without removing others, use
--memberadd.
synogroup --rename OLD_GROUPNAME NEW_GROUPNAME
synogroup --del GROUPNAME1 GROUPNAME2 ...
synogroup --descget GROUPNAME
synogroup --descset GROUPNAME "Description text"
| Command | Description |
|---|---|
--enum [{local|domain|ldap|all}] | List groups by source |
--enumpre {local|domain|all} PREFIX CASELESS | List groups with a name prefix |
--enumsub {local|domain|all} SUBSTR CASELESS | List groups with a name substring |
--get GROUPNAME | Show details for a group |
--getgid GID | Look up group by GID |
--descget GROUPNAME | Get group description |
--descset GROUPNAME "DESC" | Set group description |
--add GROUPNAME USERNAME... | Create a group with initial members |
--rename OLD NEW | Rename a group |
--member GROUPNAME USERNAME... | Replace the full member list |
--memberadd GROUPNAME USERNAME | Add a single user to a group |
--del GROUPNAME... | Delete one or more groups |
--rebuild {all|(domain FORCE)|(ldap FORCE)} | Rebuild the group database |
When adding a service account (e.g., for a Docker container) and granting it group access:
# 1. Create the user (expired=1 disables interactive login)
sudo synouser --add myservice "" "My Service" 1 "" 0
# 2. Create a group for it (or skip if adding to an existing group)
sudo synogroup --add myservice_group myservice
# 3. Add the user to an existing shared group
sudo synogroup --memberadd media myservice
# 4. Verify
synogroup --get media