The repo is public and files are fetched by raw URL, so a reader who lands
on one runbook never sees the README -- the repo's context does not travel
with the file. Each .md now carries two lines under the title, each .ps1 the
equivalent at the end of its .NOTES block.
Deliberately two lines, not a paragraph. These files are read through `| more`
on a client console mid-incident, and the top of the file is where the
procedure-specific warnings live -- never a live chart, stop the service
before copying, confirm authorization before acting. A legal preamble above
those competes with them and trains people to skip past.
Wording aims at a stranger who found the repo, not at the quality of the
procedure: these double as documented-procedure evidence for E&O, and
language implying the content is unreliable works against that.
MIT rather than no license: the warranty and liability disclaimer is the part
that does the work, and leaving it unlicensed makes reuse ambiguous rather
than disclaimed.
Also fixes 5 stale ops/rb URLs in scripts/*.ps1 that the previous commit
missed -- it only swept the .md files.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
The ops -> godwinsystems org move would have made every hand-typed onsite
command 10 characters longer, against the whole reason filenames here are
short. A redirect host makes them shorter than they ever were:
irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/od-smb-cred.md
irm rb.godwinsystems.com/od-smb-cred.md
Flips all 6 hardcoded URLs and documents what the hostname is, where the
route is defined, and that removing it means updating these commands in
the same change.
Verified before committing: the short and canonical URLs return
byte-identical content for 5 files, the scheme-less http:// form resolves
through 301 -> 302 -> 200, bare / lands on the repo page, and a missing
file still 404s at the right path.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
Numbered field checklist for a consumer Google account, usable in two
situations: capturing state before touching anything, and verifying
nobody regained access after a password reset.
Deliberately terse -- steps only, no rationale prose. This is worked
standing up in someone's office, where explanatory text between steps
makes the next action harder to find.
Covers ground sec-google-compromise.md Phase 0 does not: the Takeout
export history, which is the bulk-exfiltration path for a Google account
and produces affirmative evidence in an account tier with no audit log;
recovering Google's own security mail from Trash and Spam via
in:anywhere; pending-but-unconfirmed forwarding addresses; the native
filter XML export instead of a screenshot; and attacker-enrolled
passkeys.
Also records that Gmail keeps only ~10 recent-activity entries, so
signing out and back in destroys evidence -- capture in one sitting.
Placeholders only.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Incident response for a suspected compromise of a personal @gmail.com
account used for practice business. Written for the consumer-account
reality: no Admin console, no Admin SDK, no audit-log export, no vendor
phone support — every recovery path is Google's automated self-service
flow.
Initial vector assumed to be an AiTM credential phishing kit (blob: URI
rendering a spoofed sign-in page locally, relaying to an attacker
session), with an endpoint infostealer as an unruled-out alternative.
Both steal a post-authentication session cookie, so 2FA does not prevent
it and a password reset alone does not evict it. That drives the whole
ordering: revoke sessions, then OAuth grants, then app passwords, THEN
reset the password, then enroll phishing-resistant 2FA, then sweep Gmail
persistence. Rationale is inline so it doesn't get optimized away
mid-incident.
Phases 0-5 with durations and exit criteria: evidence preservation,
access triage (live-session branch vs. account recovery), containment,
blast radius (registrar first, then financial/vendor/licensing),
endpoint investigation (GravityZone history before scanning, policy and
exclusion audit, Autoruns/Process Explorer, RMM hunt, UniFi logs), and
documentation/handoff. Appendices for decision log and contacts.
Google UI paths verified against Google's help docs at time of writing;
deep links used over menu wording, with an appendix on their volatility.
Kaspersky tooling deliberately excluded (US distribution restrictions).
Makes no compliance determination by design — legal calls route to
counsel/compliance contact. Placeholders only; work the filled-in copy
in the private tier.
New sec- prefix for security/IR runbooks.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Automate the nightly cold backup (Task Scheduler, filled-in local copy in
private tier), stagger the off-site upload, and MONITOR with three layers:
Task Scheduler last-run, a read-only health check (freshness/completeness/
size), and a dead-man's-switch heartbeat that pings an external monitor only
on success so silent failures and offline servers get caught. od-backup-check.ps1
is read-only (no DB/service), iex-safe, and pings <HEARTBEAT_URL> on PASS.
Cross-linked with od-db-backup.md and od-backup-verify.md; README updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Verify an od-db-backup cold backup by restoring it into a throwaway,
network-isolated Hyper-V VM (revert to checkpoint after), never over live
prod. Covers matching versions from MANIFEST, whole-datadir restore for
InnoDB, re-pointing the image path, and a pass/fail health checklist
(connects, Help>About version, Database Maintenance Check, recent data,
images open, no missing tables, optional mysqlcheck). Cites Open Dental
Backups / Manual Backups / Database Maintenance. Cross-linked with
od-db-backup.md; README updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Rock-solid two-part backup (data directory + OpenDentImages) using the
cold-copy method: stop the DB service, verify it stopped, copy the whole
data dir (incl InnoDB ibdata1/ib_logfile*), then always restart the
service via a finally block. Covers mysqldump supplement, scheduling,
test-restore verification, and 3-2-1 retention.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Diagnostic tree for single-pass duplex ADF scanners feeding Open Dental
over TWAIN, keyed on the Show TWAIN UI toggle (OD Duplex checkbox vs.
scanner TWAIN dialog authoritative). Placeholders only; no client data.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Persist Open Dental's 'Do not show this window on startup' by making
FreeDentalConfig.xml writable:
- Option A: one-time elevated save
- Option B (preferred): grant Users Modify via well-known SID S-1-5-32-545
- od-cfg-acl.ps1 auto-resolves 64/32-bit install path, iex-safe conventions
- Security note on reversible MySQL password in the config; limited user / Middle Tier
- Cites OD manual freedentalconfig.html / choosedatabase.html
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Move _template.ps1 and cg-disable.ps1 into scripts/
- Update all fetch/run URLs and doc links to scripts/ paths
- Rework README layout/naming section; add as-is/no-warranty disclaimer
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
igodwin