Hello

Aim:

I have an encrypted disk and an unencrypted disk in my array. I want the unencrypted disk (or user shares on it) to be available to access in windows (mounted), while the encrypted disk (or user shares on it) to be only accessible once I’ve entered the decryption passphrase (unmounted until passphrase entered).

Questions:

1. At the moment when I start the array, the encrypted disk is unlocked (and it is not asking me to enter a passphrase) and all disks are mounted. How can I change that behavior so that only the unencrypted disk is mounted? (I want to be able to access the unencrypted disk while leaving the encrypted disk locked).

2. Why is it not asking for me to enter the passphrase to start the array including the encrypted disk? I assumed that I would need to enter the passphrase each time I want to unlock it?

3. When I want to access the encrypted disk, I want to be able to manually mount it by entering the passphrase. Can that be done in windows without having to access the webgui?

   Ideally I'd like to be able to power on the unraid server and have the unencrypted disks automounted and have them mapped in windows so they are immediately accessible.

   Also have the encrypted disks mapped in windows, but when I try to access them it's asks me for the passphrase which then decrypts and mounts the drive and allows me access.
   

Any help is much appreciated.

Thanks

Edited September 20, 2025Sep 20 by Dominoes0522

not possible...

I have an encrypted disk and an unencrypted disk in my array. I want the unencrypted disk (or user shares on it) to be available to access in windows (mounted)....

as windows doesn't understand the Linux file systems. And if software raid was used, all disk would need to be present. You wouldn't be using windows to access a encrypted unraid array of disk.

Why you can’t mount / unlock Unraid encrypted disks directly from Windows

Unraid’s encryption is handled at the Linux kernel level (LUKS/dm-crypt). This means:

• The encryption key management, passphrase entry, and disk unlocking all happen inside the Unraid OS.

• Once unlocked, Unraid mounts the disk using a Linux filesystem (typically XFS or BTRFS) and presents the data to clients (Windows, macOS, etc.) via network protocols like SMB or NFS.

Windows cannot directly read or interact with these disks because:

1. Filesystem mismatch – Windows does not understand XFS or BTRFS. Even if the disk were unencrypted, Windows can’t mount it natively.

2. Encryption layer – Windows has no built-in support for LUKS. You would need third-party Linux tools (not available in standard Windows) to even attempt a mount, and that still wouldn’t integrate with Unraid’s array.

3. Array management – Unraid isn’t like plugging in an external USB drive. It manages parity and array assignments internally. If you bypass that, you risk corrupting the array.

Why Unraid isn’t asking for a passphrase

By default, Unraid can be configured to automatically load the encryption key from a keyfile stored on the flash boot device. That’s why when you start the array, your encrypted disk is unlocked silently without prompting.

• If you want to always enter a passphrase manually, you need to remove the keyfile and force Unraid to prompt you when the array starts.

• Theres a forum that goes over this even with a secure key file to unencrypted at boot... https://weirdion.medium.com/automating-unraid-array-decryption-12a9de3f4ad7

• 

  Encrypting your data | Unraid Docs

  Encrypting your drives in Unraid adds a strong layer of protection for sensitive data, helping to prevent unauthorized access if a drive is lost or stolen. Encryption is available for the %%array|arra

Why you can’t “leave it locked but mapped in Windows”

What you’re describing—seeing a share in Windows Explorer, clicking on it, and then getting prompted for a passphrase—just isn’t possible with Unraid’s current architecture. Windows never talks to the raw encrypted disk; it only talks to the SMB share exported by Unraid. If the disk is locked, that share simply doesn’t exist until you unlock it through the Unraid webGUI (or CLI if you script it).

There’s no mechanism for Windows to pass a LUKS passphrase to Unraid. That step has to be done server-side.

What is possible

• Have your unencrypted disks auto-mount at array start and expose those shares to Windows.

• Keep your encrypted disks locked at array start (remove the keyfile).

• When you want access, log into the Unraid webGUI, enter the passphrase, and then the shares on that encrypted disk will appear to Windows like normal network folders.

If you want a smoother workflow, you could script the unlock process on the server side, but it will still require a passphrase entry in Unraid, not Windows.

review:

https://forums.unraid.net/topic/162128-how-can-one-securely-autostart-an-encrypted-unraid-array/

https://forums.unraid.net/topic/137748-best-way-to-encrypt-exist-disks/