Move runbooks into domain directories

od-db-backup.md becomes od/db-backup.md -- the hyphen becomes a slash, so
the fetch command is exactly as long to type as before. That mattered: the
length of a hand-typed command is the constraint this repo is organized
around, and a reorganization that lengthened it would have been a net loss.

Scripts deliberately stay flat in scripts/ with their domain prefix.
Everything executable in one directory is the set worth reading before it
runs, and nesting five files by domain would add characters without adding
clarity.

Updates every reference: README Contents (now grouped by directory), the
layout section, both fetch examples, inter-runbook links, and the .NOTES
headers in all five scripts. Verified every markdown link resolves on disk
and that Contents and the filesystem agree in both directions.

Records the naming rule in CONTRIBUTING so the next file lands correctly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7

od/smb-cred.md

@@ -0,0 +1,137 @@
+# Runbook: Open Dental SMB Share Access — Stored Credential Fix
+
+> For qualified IT professionals, on systems they are authorized to administer.
+> Provided as-is, without warranty — verify it fits your environment. See LICENSE.
+
+**Applies to:** Entra-joined Windows workstation accessing an Open Dental A-to-Z share on a standalone (non-domain, non-Entra) server via local SAM credentials.
+**Symptom:** Open Dental cannot reach `\\<SERVER>\<SHARE>` after workstation restart; works after manually connecting via File Explorer.
+**Root causes covered:** missing/stale stored Windows credential; Credential Guard blocking saved credential replay; elevated process not seeing user-session credentials.
+
+**Placeholders:**
+
+| Placeholder | Meaning |
+|---|---|
+| `<SERVER>` | Application server hostname |
+| `<SHARE>` | Share name (e.g. OpenDentImages) |
+| `<SHARE_USER>` | Local account on `<SERVER>` used for share access |
+| `<PASSWORD>` | From password manager — never stored in this file |
+
+---
+
+## 1. Confirm identity of the machine
+
+```
+hostname
+```
+
+Verify you're on the machine you think you're on before changing anything.
+
+## 2. Check Credential Guard status
+
+```
+msinfo32
+```
+
+System Summary → **Virtualization-based security Services Running**
+
+- Credential Guard **not listed** → skip to Step 4
+- Credential Guard **listed** → do Step 3
+
+> Context: Credential Guard blocks the replay of saved "Windows credentials" from Credential Manager. Symptom is exactly "works after manual Explorer connect, breaks on restart." Enabled by default on Windows 11 22H2+ on entitled SKUs (Enterprise/Business), not plain Pro.
+
+## 3. Disable Credential Guard (ONLY if running)
+
+Fastest, from an **elevated** PowerShell:
+
+```
+irm rb.godwinsystems.com/scripts/cg-disable.ps1 | iex
+```
+
+It confirms, clears the flags, and prompts to reboot.
+
+Offline / manual equivalent (elevated PowerShell or Command Prompt):
+
+```
+reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 0 /f
+reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
+shutdown /r /t 0
+```
+
+After reboot: re-run msinfo32 and confirm Credential Guard is no longer listed, then continue.
+
+> If it's still running after reboot, it was enabled with UEFI lock — requires the bcdedit/physical-presence removal procedure. Also check whether MDM policy is re-enabling it; align with the environment's baseline rather than fighting it locally.
+
+## 4. Review existing stored credentials
+
+Regular (NON-elevated) Command Prompt, logged in as the user who runs Open Dental:
+
+```
+cmdkey /list
+```
+
+- Record any entries for `<SERVER>` (by hostname or IP) before deleting.
+- Delete existing entries for the server:
+
+```
+cmdkey /delete:<SERVER>
+```
+
+Repeat for IP-based entries if present. Duplicate entries for the same server (hostname + IP) cause intermittent 1219-style conflicts — clear all of them.
+
+## 5. Add the credential
+
+Same non-elevated prompt (elevated prompts write to the wrong credential vault):
+
+```
+cmdkey /add:<SERVER> /user:<SERVER>\<SHARE_USER> /pass:"<PASSWORD>"
+```
+
+Quote the password if it contains special characters.
+
+## 6. Verify it stored
+
+```
+cmdkey /list
+```
+
+Expect an entry with `Target: <SERVER>`.
+
+## 7. Cold test
+
+```
+shutdown /r /t 0
+```
+
+Log in as the Open Dental user. Launch Open Dental **directly — do not open Explorer or touch the share first.**
+Open the Imaging module → confirm images load.
+
+**PASS → done.** Record results.
+
+## 8. If Step 7 fails — isolate
+
+```
+dir \\<SERVER>\<SHARE>
+```
+
+| Result | Meaning | Action |
+|---|---|---|
+| `dir` fails | Stored credential not being used | `cmdkey /list` — confirm entry survived reboot; re-check msinfo32 for Credential Guard |
+| `dir` works, Open Dental doesn't | Open Dental launching elevated | Shortcut → Properties → Advanced → uncheck "Run as administrator"; also check Compatibility tab. Retest. If elevation is required, set `EnableLinkedConnections` (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, DWORD=1) and reboot. |
+
+## Fleet comparison (optional, ~2 min)
+
+On a known-working workstation:
+
+```
+cmdkey /list
+```
+
+Record what it stores for `<SERVER>` — documents the fleet's credential state and reveals inconsistencies (per-machine manual setups, stale accounts).
+
+---
+
+## Notes
+
+- The Open Dental A-to-Z path stored in Setup → Data Paths is **global** (database-stored). The "Path override for this computer" field is per-workstation. Never change the global path to a mapped drive letter to fix one machine.
+- Prefer a dedicated low-privilege local account on `<SERVER>` scoped to the share only — not an administrative account.
+- Rotating the share account's password silently breaks stored credentials on every workstation using it. Inventory which machines hold it (Step 4 on each) before rotating.