SMB file servers and NAS

Step 1: Create a read-only scan account

Choose your server below. Labels vary by NAS release. Review inherited group grants too: a read-only user grant does not remove write rights from another group.

Windows file server

1. For a domain account, open Active Directory Users and Computers → Users → New → User. Create myrikeep_scan as an ordinary user. For a standalone server, use Computer Management → Local Users and Groups → Users → New User.
2. On the selected folder, open Properties → Sharing → Advanced Sharing → Permissions. Add the account and allow Read only.
3. Open Properties → Security → Edit → Add. Add the same account and allow Read & execute, List folder contents and Read. Check inheritance reaches the intended files. Do not replace other users' ACLs.
4. In Security → Advanced → Effective Access, select the account and verify the intended files are readable. Avoid membership in Administrators or Backup Operators.

Synology DSM

1. Control Panel → User & Group → User → Create: create myrikeep_scan, without membership in administrators.
2. Control Panel → Shared Folder → select share → Edit → Permissions: select local users and grant this account Read only for the chosen share.
3. In File Station, open the target folder's Properties → Permission. Check inherited read, list and traverse rights on the intended subfolders. Remove conflicting grants for this scan account only.

See Synology shared-folder permissions.

TrueNAS

1. In SCALE, Credentials → Users → Add: create an ordinary local user and enable SMB Access (older releases call this Samba Authentication). Do not choose an administration role. CORE uses Accounts → Users → Add.
2. Datasets → select dataset → Permissions → Edit ACL: add a user entry with the Read preset, with traversal on parent datasets as needed. Check inheritance; do not strip or replace the existing ACL.
3. Shares → Windows (SMB) Shares → select share → Edit Share ACL: grant the user READ. CORE calls the shares menu Sharing. Keep the SMB service enabled. Root cannot be the SMB scan account.

See TrueNAS SMB shares and user accounts.

Unraid

1. Users → Add User: create myrikeep_scan with a password. Use a share user; the root administration account cannot log into SMB shares.
2. Shares → select share → SMB Security Settings: set Export to Yes and Security to Private.
3. In SMB User Access, give the scan user Read-only for this share. Leave unrelated users' permissions intact. Check filesystem permissions if existing files still cannot be read.

See Unraid share security.

QNAP QTS / QuTS hero

1. Control Panel → Privilege → Users → Create → Create a User: create myrikeep_scan without administrator group membership.
2. Control Panel → Privilege → Shared Folders → select share → Edit Shared Folder Permission: choose the user and set Read Only (RO).
3. If Advanced Folder Permissions or Windows ACL support is enabled, inspect the selected folder's permissions and inherited read/traverse entries too. Keep the scan account unable to change files or permissions.

See QNAP folder permissions.

Step 2: Check SMB and account settings

Enable SMB2 or SMB3 on the server; SMB1 is unsupported. Keep SMB signing enabled or required. The agent uses the SMB client's negotiated protocol and signing; there is no console dialect/signing switch. In DSM these controls are under Control Panel → File Services → SMB → Advanced Settings; see Synology SMB settings.

For a domain user, put myrikeep_scan in secret username and the NTLM domain such as EXAMPLE in domain. The agent logs in as EXAMPLE\myrikeep_scan. For a NAS/local user, omit domain unless the server requires its NetBIOS name. Use the server account, not an unrelated account on the agent host.

Step 3: Add the connection

Open Connections → Add connection, select SMB file share, assign your agent, and choose Local credential catalog. Enter the host and share name separately. Save the credential files below on the agent. Wait for present, then queue a small scan in Scans. Check Coverage as well as Findings.