I think I have locked myself out from a Synology DSM Web access. When I was logged in, I removed all "granted by default" privileges, and apparenlty one of them (Desktop?) affected my administration account. Now when I get to the login page, I successfully fill username, password and 2nd verification and then I got a "You are not authorized" error (note: my IP is not auto-blocked). I have all passwords and can access the device via ssh and the data via SMB.

All I could research is to do a soft reset, but I am not sure whether this will fix privileges too and I would prefer not to destroy my current configuration.

By using ssh, is there a way I can fix the privileges to add my custom administration user to log in to DSM? I've been exploring some files on /etc with no much success.

2 Answers 2


Thanks to Tonny's confirmation about Desktop I was able to fix the problem, so I will share because it is a bit frustrating if this happens to you....

After successfully inserting the passwords in DSM, the error is something like this: You are not authorized to use this service. "You are not authorized to use this service."

Steps to fix the problem if you accidentally locked yourself out of the DSM Web access:

  1. You need to have ssh access, and use an administrator user. If you don't, you probably need to do a soft reset.
  2. (I am using Linux) Execute: ssh your_username@your_synology_ip
  3. cd /etc
  4. grep your_username /etc/passwd (e.g. grep administrator /etc/passwd) The answer will be something like administrator:x:1021:100::/var/services/homes/administrator:/bin/sh You are interested in your id, in the example: 1021
  5. Make a backup of the database, just in case: cp synoappprivilege.db synoappprivilege.db.org
  6. sudo sqlite3 synoappprivilege.db It will ask for your password. Insert the password of your_username (same password you used for ssh). It will prompt:

    SQLite version 3.10.2 2016-01-20 15:27:19
    Enter ".help" for usage hints.
  7. Check tables (not strictly necessary):

    sqlite> .tables
  8. Query table (not strictly necessary):

     sqlite> select * from AppPrivRule;

    This will dump the contents of the table, which will be similar to these:

  9. The priviledge we unintentionally removed was SYNO.Desktop and will probably not be listed in the previous command. So we need to insert it (note: use your user id as obtained before with grep, in my case, 1021):

    sqlite> insert into AppPrivRule VALUES(0,1021,'SYNO.Desktop','','0000:0000:0000:0000:0000:FFFF:0000:0000','','');
  10. Confirmation that everything is all right...

    sqlite> select * from AppPrivRule;

DONE! You can now log in.

After I fixed the problem I found the same solution here, but it was impossible to get from search engines on the first instance. Also, beware the insert in that link has a small mistake.

  • 1
    Glad I was able to steer you in the right direction. And a very nicely written up answer. Well done! Have some points from me :-)
    – Tonny
    Mar 23, 2017 at 14:41
  • 2
    Perfect answer, fixed it instantly. Aug 16, 2017 at 10:43
  • 2
    This also works with DSM 7.0beta, and saved me today. If you have an additional Administrator account, a soft reset will just reset the password of the additional Account. (If you log in with admin and empty password). I additionally had to delete all my deny rules too, to solve it. delete from AppPrivRule where App='SYNO.Desktop' and ID!='1021' (also replace the 1021 with your user id)
    – iantsch
    Feb 27, 2021 at 18:54
  • 1
    Worked with DSM 7.1.1, you saved my day! Mar 12 at 10:48

Interresting question. I did a bit of digging around on my own Syno and came up with this:

Look in /etc/group via ssh. There should be a line looking like:


("plex" is only there if you installed the Plex package.)

Add your admin account to that line. As far as I know that is the only thing needed to get into DSM web-managment. For the normal web-server access (personalized home-page) user must also be added to the "http" line in the same file.

Next thing is to pull the file /etc/synoappprivilege.db to a computer (carefull, this is a binary. Don't copy in text mode.)
This is a SQLite database containing the actual privileges.
Load this file in a HEX editor and look for the Desktop section.
This should look like:


The YNO and MW could have different values. The important part are the numbers. These should be the same as show above.
Change this using the HEX editor and put the modified file back on the Syno (keep a backup-copy of the original!!!).

I'm not sure this change is picked up auto-magically, so a reboot may be needed to activate the new setting.

  • Thanks! My user was already in the administrators line. I added it also at the end of the line http. I tried to log in just in acse but did not work. However, now I try to modify the .db file but there is no line with Desktop... perhaps that is why I cannot access? Perhaps there is a way to modify it via sqlite3 Mar 23, 2017 at 13:48
  • I got it - posting an answer... Mar 23, 2017 at 14:04
  • Thank you Tonny, even though I had already looked at synoappprivilege.db you gave me all the hints to know that SYNO.Desktop should be there to find a solution! You saved my day! Mar 23, 2017 at 14:37
  • Thanks for this answer! I had added my user to a group that revoked the desktop rights (after installing GIT). After reading this I was able to remove myself from the new group by editing the file using sudo vi /etc/group. Now I can log in again! May 24, 2022 at 22:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .