Root cause and fix: "Finder wants to make changes" loop with Synology sync clients on macOS Tahoe
This prompt has come up in several Apple Community threads, all now closed without a real answer:
- https://discussions.apple.com/thread/256153258 (identified Synology Drive as the trigger, workaround was revoking Full Disk Access)
- https://discussions.apple.com/thread/256190363 (workaround was reinstalling the client)
- https://discussions.apple.com/thread/256169495 (German, same conclusion)
Those workarounds either break sync or only hold until the trigger recurs. I hit the same loop on macOS 26 with Cloud Station Drive and traced the actual mechanism. Synology Drive Client uses the same Finder refresh, so this applies to both.
What's happening:
Every time the Synology client processes a folder, it runs an AppleScript against Finder to refresh overlay icons:
tell application "Finder"
update every item of <folder>
end tell
On Tahoe, if that folder contains a file your user can't write to, Finder's refresh needs admin rights to touch the file's metadata. Finder's helper requests authorization, and that's the "Finder wants to make changes" dialog. Confirm it with:
log show --last 1h --predicate 'process == "authd"' | grep -i desktopservices
You'll see the right com.apple.desktopservices requested by DesktopServicesHelper "for authorization created by Finder.app".
Why it loops
The Synology client can't write that file either, so it logs "Unable to handle locked/no permission file" and retries constantly, about 45 times a minute in my case. Each retry refreshes the folder in Finder, which raises the prompt again. Cancelling just defers it to the next retry.
The fix
Find files in your sync folder that aren't writable by you:
find ~/CloudStation -type f ! -perm -u+w
Replace ~/CloudStation with your sync folder. For me it was one file, a zip downloaded years ago with read-only permissions. Make it writable:
chmod u+w "/path/to/the/file"
The prompts stopped immediately and the client synced the file on its next pass. No need for a Full Disk Access change, no reinstall.
To see which file is responsible before changing anything, check the client's own log. For Cloud Station Drive:
grep "Unable to handle locked" ~/.CloudStation/log/daemon.log
For Synology Drive Client, the logs are under ~/Library/Application Support/SynologyDrive/log/.