Record per-device TrueNAS SED passwords before relying on a global password

Bottom line: Identify which drives use individual passwords before treating the global SED password as the complete unlock plan. Keep physical drive identities, the credential-selection rule and the authorized retrieval path together without putting secret values into the ordinary asset record.

Source fact: what the authority says

The TrueNAS SED guide limits UI management to the Enterprise-licensed feature in TrueNAS 25.04 and later; it says those options are not visible in Community Edition. It says SEDs are not locked by default until an administrator takes ownership through an explicitly configured global or per-device password. At boot, devices with individual passwords use those passwords; devices without a device-specific password use the global password. The guide warns that losing the SED password prevents unlocking the drives and accessing their data.

What the source does not establish

This article addresses the documented credential-selection and UI scope. It does not certify a drive model, approve a cryptographic-erasure operation or establish that a particular disk is locked. DSE treats device support and any command-line ownership change as separate reviews requiring the applicable manufacturer guidance.

Applicability questions

• Which physical drives are in scope, and what identifiers distinguish them?
• Does each have an individual password, or is the global-password path intended?
• Does the installed edition and release provide the documented management interface?
• Who may retrieve the correct credential during an approved boot or recovery exercise?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends a protected credential map with one row per drive identity. Record the intended selection as individual or global and a reference to the authorized secret store, never the password itself. Have the storage owner check the map against the actual configuration. Keep an unknown ownership or password state unresolved rather than labeling every detected SED protected.

Use a proposed mixed-population review: one drive intended to use the global password and another already assigned an individual password. Ask the recovery operator to identify the correct retrieval path for each. Resolve missing custody, unclear device identity or a mismatch between the recorded edition and the expected UI before planning a change.

Keep the first exercise observational wherever possible. Do not change ownership, erase a disk or reset credentials merely to demonstrate that the procedure exists. For Enterprise management, involve the appropriate support route when the actual device state is uncertain. Coordinate any planned restart with the workload owner and a protected recovery plan for the data.

Include a proposed newly added drive in the paper review and ask who must update the credential map. Require a clear answer for an individual-password exception instead of defaulting every new inventory row to global. Keep secret retrieval evidence within the authorized access record.

Verification and evidence

Proposed verification: under an approved representative recovery plan, have an authorized operator retrieve the intended credential reference for each proposed drive case and perform only the documented, permitted unlock check. Record the actual device identity, chosen credential class and observed result without retaining secret values in the evidence package.

Reconcile the result with the per-drive map and have a second reviewer identify any missing or ambiguous record. Keep failed or unperformed checks visible. Review credential custody after a drive replacement or ownership change, and reassess edition-specific guidance after an upgrade. Preserve data recovery evidence separately from the narrower conclusion that the reviewed unlock path was observed.

Official references

• TrueNAS — Managing Self-Encrypting Drives (SED) — official product documentation; confirm the installed release and configuration.

Source review completed October 28, 2026. Recheck the official documentation and deployment-specific applicability before a production change.