The ops -> godwinsystems org move would have made every hand-typed onsite
command 10 characters longer, against the whole reason filenames here are
short. A redirect host makes them shorter than they ever were:
irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/od-smb-cred.md
irm rb.godwinsystems.com/od-smb-cred.md
Flips all 6 hardcoded URLs and documents what the hostname is, where the
route is defined, and that removing it means updating these commands in
the same change.
Verified before committing: the short and canonical URLs return
byte-identical content for 5 files, the scheme-less http:// form resolves
through 301 -> 302 -> 200, bare / lands on the repo page, and a missing
file still 404s at the right path.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
Numbered field checklist for a consumer Google account, usable in two
situations: capturing state before touching anything, and verifying
nobody regained access after a password reset.
Deliberately terse -- steps only, no rationale prose. This is worked
standing up in someone's office, where explanatory text between steps
makes the next action harder to find.
Covers ground sec-google-compromise.md Phase 0 does not: the Takeout
export history, which is the bulk-exfiltration path for a Google account
and produces affirmative evidence in an account tier with no audit log;
recovering Google's own security mail from Trash and Spam via
in:anywhere; pending-but-unconfirmed forwarding addresses; the native
filter XML export instead of a screenshot; and attacker-enrolled
passkeys.
Also records that Gmail keeps only ~10 recent-activity entries, so
signing out and back in destroys evidence -- capture in one sitting.
Placeholders only.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Incident response for a suspected compromise of a personal @gmail.com
account used for practice business. Written for the consumer-account
reality: no Admin console, no Admin SDK, no audit-log export, no vendor
phone support — every recovery path is Google's automated self-service
flow.
Initial vector assumed to be an AiTM credential phishing kit (blob: URI
rendering a spoofed sign-in page locally, relaying to an attacker
session), with an endpoint infostealer as an unruled-out alternative.
Both steal a post-authentication session cookie, so 2FA does not prevent
it and a password reset alone does not evict it. That drives the whole
ordering: revoke sessions, then OAuth grants, then app passwords, THEN
reset the password, then enroll phishing-resistant 2FA, then sweep Gmail
persistence. Rationale is inline so it doesn't get optimized away
mid-incident.
Phases 0-5 with durations and exit criteria: evidence preservation,
access triage (live-session branch vs. account recovery), containment,
blast radius (registrar first, then financial/vendor/licensing),
endpoint investigation (GravityZone history before scanning, policy and
exclusion audit, Autoruns/Process Explorer, RMM hunt, UniFi logs), and
documentation/handoff. Appendices for decision log and contacts.
Google UI paths verified against Google's help docs at time of writing;
deep links used over menu wording, with an appendix on their volatility.
Kaspersky tooling deliberately excluded (US distribution restrictions).
Makes no compliance determination by design — legal calls route to
counsel/compliance contact. Placeholders only; work the filled-in copy
in the private tier.
New sec- prefix for security/IR runbooks.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Automate the nightly cold backup (Task Scheduler, filled-in local copy in
private tier), stagger the off-site upload, and MONITOR with three layers:
Task Scheduler last-run, a read-only health check (freshness/completeness/
size), and a dead-man's-switch heartbeat that pings an external monitor only
on success so silent failures and offline servers get caught. od-backup-check.ps1
is read-only (no DB/service), iex-safe, and pings <HEARTBEAT_URL> on PASS.
Cross-linked with od-db-backup.md and od-backup-verify.md; README updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Verify an od-db-backup cold backup by restoring it into a throwaway,
network-isolated Hyper-V VM (revert to checkpoint after), never over live
prod. Covers matching versions from MANIFEST, whole-datadir restore for
InnoDB, re-pointing the image path, and a pass/fail health checklist
(connects, Help>About version, Database Maintenance Check, recent data,
images open, no missing tables, optional mysqlcheck). Cites Open Dental
Backups / Manual Backups / Database Maintenance. Cross-linked with
od-db-backup.md; README updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Off-site replication (Duplicati->B2, rclone, Veeam, etc.) should back up the
cold-copy output under <DEST>, not re-crawl C:\mysql\data. The od-backup-*
folders are already consistent; a naive hot copy of a live InnoDB datadir is
corrupt. Adds sequencing guidance (run off-site job after the cold backup;
stagger schedules) and layered off-site encryption/immutability.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Per Open Dental docs a complete backup is the database + A-to-Z images; the
program itself is not backed up but reinstalled at the matching version on
restore. Extend the script to capture two recovery aids best-effort (outside
the downtime window): a copy of FreeDentalConfig.xml and the exact Open Dental
+ MySQL/MariaDB versions, recorded in MANIFEST.txt. Runbook now spells out
what is/isn't backed up and notes the config file holds the obfuscated DB
password on direct-connect setups.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Rock-solid two-part backup (data directory + OpenDentImages) using the
cold-copy method: stop the DB service, verify it stopped, copy the whole
data dir (incl InnoDB ibdata1/ib_logfile*), then always restart the
service via a finally block. Covers mysqldump supplement, scheduling,
test-restore verification, and 3-2-1 retention.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Diagnostic tree for single-pass duplex ADF scanners feeding Open Dental
over TWAIN, keyed on the Show TWAIN UI toggle (OD Duplex checkbox vs.
scanner TWAIN dialog authoritative). Placeholders only; no client data.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Persist Open Dental's 'Do not show this window on startup' by making
FreeDentalConfig.xml writable:
- Option A: one-time elevated save
- Option B (preferred): grant Users Modify via well-known SID S-1-5-32-545
- od-cfg-acl.ps1 auto-resolves 64/32-bit install path, iex-safe conventions
- Security note on reversible MySQL password in the config; limited user / Middle Tier
- Cites OD manual freedentalconfig.html / choosedatabase.html
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Move _template.ps1 and cg-disable.ps1 into scripts/
- Update all fetch/run URLs and doc links to scripts/ paths
- Rework README layout/naming section; add as-is/no-warranty disclaimer
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
igodwin