Flamingo Raises $4.5M Seed Round · Led by Vertex Ventures, bringing total funding to $6.7M to build the open, AI-native layer for IT and security.
Conrad Lunderstedt
A buyer's guide for small offices choosing between a NAS, a Windows file server and SharePoint with OneDrive, covering identity, ransomware exposure, SMB signing, backups, cost and who keeps it running.
Every small office reaches the day when the shared folder outgrows somebody's desktop, and the choice lands on whoever looks after IT. The options are a box that only stores files, a Windows server that does it among other jobs, or handing the whole problem to Microsoft 365. This guide walks through the nas vs server decision the way it plays out for a 5 to 50 person office, with the identity, backup and security questions that settle it.
A NAS, network attached storage, is a small computer built to do one job. It holds a set of disks, runs a cut-down operating system from the vendor, and serves folders over SMB to Windows and macOS, often with NFS and a web interface on top. You buy it, put disks in, click through a setup wizard, and it is sharing files within the hour. Synology, QNAP, Asustor and TrueNAS are the names that come up in small offices.
A Windows file server is a general purpose server running Windows Server with the File Server role. It shares folders over the same SMB protocol, but every share and permission is native Windows, so it lines up with Active Directory without translation. It can also run other things: a print server, a line-of-business database, the domain controller itself in a very small office.
The third option skips local storage. SharePoint document libraries and OneDrive, both included in Microsoft 365 business plans, hold the files in Microsoft's cloud, sync them to laptops, and handle permissions through Entra ID. There is no box in the cupboard, and no disk to fail.
The protocol underneath the first two is the same. Our SMB explainer covers how that sharing works on the wire, and why the version a device speaks matters later in this guide.
| What matters | NAS | Windows file server | SharePoint and OneDrive |
|---|---|---|---|
| Setup | Wizard, an hour or two | Windows Server install, roles, shares, a day | Tenant settings and sync policy |
| Permissions | Own users, or joined to AD for domain groups | Native NTFS and share permissions with AD groups | Entra ID groups and sharing links |
| Large local files (CAD, video, scans) | Fast on the LAN | Fast on the LAN | Slow to sync, can hit file size limits |
| Snapshots | Built in on most models | Volume Shadow Copies, "Previous versions" | Version history and a recycle bin |
| Offsite copy | Add-on: cloud sync, second NAS, backup agent | Backup software to another site or cloud | Microsoft holds it, but retention is not a backup |
| Patching | Vendor firmware, on the vendor's schedule | Monthly Windows updates | Microsoft patches it |
| Licensing | Hardware only | Windows Server licence plus CALs | Included in most Microsoft 365 business plans |
| Who can run it | Anyone careful with a checklist | Someone comfortable with Windows Server | Whoever runs the Microsoft 365 tenant |
Two rows decide most offices: permissions and who can run it. The rest either has an equivalent on every side or follows from those two.
The quietest way a NAS goes wrong is local accounts. The wizard creates users on the box, the office adds a login per person, and two years later nobody remembers who has access to what or why the person who left in spring can still open the finance share.
Every serious NAS can join Active Directory, and once joined it uses domain groups for share and folder permissions the way a Windows server does. That one step removes the second set of passwords and makes offboarding a single change in the directory. If the office already has a domain controller, joining is the default. If it does not, the question becomes whether a domain is worth running at all, which the domain controller guide covers.
The r/sysadmin thread below is the question in its usual form. A 130-user business is replacing a file server that holds 13 TB for one team, and the poster does not see the point of buying a server and CALs to serve files. The replies are mostly from people running Synology units as file servers at that size, and the consistent advice is the same three points: join it to the domain, use a RAID level that survives two disk failures, and back it up somewhere else.
One reply in that thread corrects a common assumption about cost. If the users already sit in the domain, their user CALs already cover any Windows server they reach, so a second file server does not add CALs on its own.
A Windows file server inside the office is rarely published to the internet. A NAS often is, because the vendors make remote access a feature: a cloud relay, a mobile app, a "QuickConnect" style service, a web admin page with port forwarding set up by the wizard. That convenience is the reason NAS boxes have their own ransomware families.
DeadBolt is the clearest case. In January 2022 it hit QNAP devices exposed to the internet, encrypting files on the NAS itself and leaving a ransom note in the web login page. Censys counted 4,988 infected services at the peak on January 26, 2022, out of roughly 130,000 QNAP devices reachable online at the time, as reported by Security Affairs. The Photo Station flaw it used, CVE-2022-27593, sits in CISA's Known Exploited Vulnerabilities catalog with a note tying it to the DeadBolt campaign.
Qlocker came before it, in 2021, and used hard-coded credentials in QNAP's own backup app, Hybrid Backup Sync, to pack every file into password-protected archives. eCh0raix went after both QNAP and Synology. The pattern repeats across vendors and years: an admin service reachable from the internet, a firmware update nobody applied, and a box that holds every file the company owns.
The fix costs nothing. Turn off the vendor's cloud relay and any port forwarding to the NAS, reach it remotely only over the office VPN, turn on automatic firmware updates for security releases, and disable apps nobody uses, because every app is another service to exploit. A NAS that is invisible from the internet loses most of the risk that makes this section necessary.
Older and cheaper NAS units have a second problem that shows up as a help desk ticket rather than a ransom note. Microsoft has tightened the SMB client step by step, and Windows 11 24H2 finished the job. Per Microsoft's guest logon documentation, "SMB signing is required by default for Windows 11, version 24H2, Windows Server 2025, and later builds", and guest access to a remote share has been off by default on Windows 11 Pro since build 25267.
A NAS that serves folders to "everyone" through a guest account, or that does not support signing, stops opening on new laptops. The usual error is 0x80070035, and the fix order is in our guide to error 0x80070035. The short version: give the NAS real accounts or domain join, turn signing on in its SMB settings, and update the firmware. Re-enabling insecure guest logons on every laptop is the workaround Microsoft warns against, because it lets a spoofed server collect connections without a password prompt.
This is the one area where a Windows file server simply avoids the problem. It speaks the same SMB dialect as the client and signs by default.
The replacement conversation often starts with "the NAS is RAID, so we're covered." RAID keeps the share online when one disk dies. It does nothing when a user deletes a folder, when ransomware encrypts the share, or when the office floods. The trade-offs between RAID levels and plain disks are in our JBOD vs RAID explainer.
Snapshots cover the next layer. A NAS snapshot, or Volume Shadow Copies on a Windows server, freezes the share at a point in time, so a deleted folder comes back from "Previous versions" in a minute. On most NAS models the snapshots can be made read-only for a set period, which helps against ransomware that encrypts the live files. They still live on the same box, so a dead NAS or a stolen one takes them with it.
Backups are the copy somewhere else. The r/sysadmin thread below is a small business with two aging NAS units, one simply mirroring the other, and an MSP quoting a like-for-like replacement. The most useful reply spells it out: the business has two copies of its data, both on identical media, both in the same building, so a fire takes both.
Whatever stores the files, the plan needs a copy that leaves the site and that the NAS or server cannot delete. Our guide to immutable backups covers how to make that copy survive an attacker with admin rights.
The admin panel tells you most of what you need to know about a NAS before you open a single share.
Hardware prices change too often to print, so compare the shape of the cost instead. A NAS front-loads it: the box and the disks on day one, then disk replacements as they fail and a full refresh when the vendor ends firmware support for the model. There is no software licence, and the support cost is the hours someone spends on it.
A Windows file server carries a licence on top of the hardware, and CALs where users are not already covered by the domain. It also asks for more of someone's time: monthly patches, a reboot window, and the Windows skills to manage permissions and shadow copies. In return it can carry other workloads that would otherwise need their own box.
SharePoint and OneDrive move the cost to the subscription the office probably already pays. The hidden costs sit elsewhere: sync problems with large files, migration work, and a backup product for Microsoft 365, because retention policies are not a restore plan.
This walkthrough covers the same features and trade-offs from the small business side, and is a reasonable thing to send to an owner who has to approve the spend.
The question owners skip is who will maintain the thing in year three. A NAS asks for little, which is why it gets forgotten: firmware notices go to an inbox nobody reads, a disk sits degraded for weeks, and the remote access feature somebody switched on during setup is still on. A Windows server gets attention because it breaks louder, and because Windows updates arrive on a schedule whether anyone wants them or not.
Either way, the job is a short monthly checklist: firmware or Windows updates applied, disk health green, snapshots running, the offsite backup tested, and nothing reachable from the internet that should not be. On the laptop side, a script that reports which machines map which shares and whether their SMB client still allows guest logons catches the next 24H2 surprise before the tickets do. If you run OpenFrame, that script runs across a client's devices and the output is collected in one place.
A NAS wins in an office with large local files, CAD drawings, video, scanned archives, and no one who wants to run Windows Server. It should be domain joined if there is a domain, invisible from the internet, and backed up offsite.
A Windows file server wins when the office already runs a domain controller and Windows Server, when shares need fine-grained NTFS permissions and auditing, or when the same box has another job to do. It also wins when older line-of-business software expects a Windows share and nothing else.
Neither wins when the files are mostly Office documents, the team works from home half the week, and nobody needs a 20 GB file at LAN speed. Then SharePoint and OneDrive do the job, and the cupboard stays empty. Where the office network itself is still being planned, the small office network design checklist settles where a NAS or server would plug in.
Pick the option the office can keep patched and backed up for five years, not the one with the longest spec sheet. A domain joined NAS that nobody can reach from the internet beats a server that never gets its updates. For the backup layer that every option needs, our roundup of backup solutions for small business is the next read.
Solution Architect
I'm Conrad, Solution Architect at Flamingo. I've spent about 26 years in IT, roughly half of it inside MSPs and the rest in enterprise environments, so I've watched vendor decisions get made on both sides of that line. Now I spend my days talking with MSPs about the stack they already run, and helping them work through the requests and issues that come with it.
Still deciding?
Ask Mingo answers from our docs and customer stories.
Still deciding?
Ask Mingo answers from our docs and customer stories.