rb — runbooks

Generic, reusable IT procedures and scripts for MSP field work. Fetched onto client workstations during on-site work with short, hand-typeable commands.

Warning

This repository is PUBLIC-READ. It must never contain client-identifying information — no client names, hostnames, IPs, usernames, credentials, or screenshots. Procedures with placeholders only. See CONTRIBUTING.md for the sanitization rule.

For qualified IT professionals, on systems they are authorized to administer. Provided as-is, without warranty — verify anything here fits your environment before running it. Scripts execute in your own session via iex; read them first. Licensed under MIT. Contains no client-identifying data by policy.

Using a runbook

Fetch and read on the target workstation:

irm rb.godwinsystems.com/od/db-backup.md | more

Run an executable runbook script directly (scripts live under scripts/):

irm rb.godwinsystems.com/scripts/od-db-backup.ps1 | iex

Scripts prompt for anything client-specific via Read-Host — nothing to edit before running. See scripts/_template.ps1 for the convention.

No scheme is needed: PowerShell defaults a scheme-less URI to http://, and rb.godwinsystems.com answers on :80 with a 301 to HTTPS.

About that hostname

rb.godwinsystems.com is a 302 redirect to this repo's raw path on Gitea. It exists because these commands are hand-typed on client machines, often mid-incident — the canonical URL is 63 characters before the filename. The canonical form still works and is what the redirect targets:

https://gitea.ivangodwin.com/godwinsystems/rb/raw/branch/main/<dir>/<file>.md

The redirect is a backendless Gateway API HTTPRoute defined in kubernetes-gitops at manifests/apps/rb-redirect/, with a listener on the public gateway and a DNS-only A record for rb. If that route is ever removed, update the commands above in the same change — otherwise every runbook here documents a dead URL.

Layout & naming

od/        Open Dental
sec/       Security / incident response
scripts/   Executable .ps1 — one flat namespace, prefixed by domain

• Runbooks (.md) live in a domain directory, named without a prefix — the directory is the prefix. od/db-backup.md, not od-db-backup.md.
• Scripts (.ps1) stay flat in scripts/ and keep their domain prefix. One directory holds everything executable, which is the set worth auditing before a change; _template.ps1 sorts first as the convention reference, not a runnable runbook.
• Meta (README.md, CONTRIBUTING.md, LICENSE) stays at the root.

The split is deliberate: the fetch command's length is the constraint this repo is organized around, and od/db-backup.md is exactly as long to type as od-db-backup.md was — the hyphen became a slash. Nesting scripts by domain too would add characters without adding clarity to a five-file directory.

Domain directories, as they are needed:

Directory	Domain
win/	Windows workstation / server
m365/	Microsoft 365 / Entra
od/	Open Dental
net/	Networking
sec/	Security / incident response

Non-interactive scripts (Intune remediations) get their own sibling directory when they arrive — not scripts/, which is for iex-safe interactive ones.

Placeholder conventions

Fill these from the private tier (private repo or Bitwarden secure note) at run time — never commit filled-in values.

Placeholder	Meaning
<CLIENT>	Client / site identifier
<SERVER>	Server hostname
<SHARE>	Share name
<SHARE_USER>	Local account used for share access
<USER>	End-user account
<PASSWORD>	From password manager — never written to a file

Contents

Open Dental — od/

File	Purpose
od/smb-cred.md	Open Dental SMB share — stored-credential fix
od/cfg-persist.md	Open Dental — persist "Do not show this window on startup" (writable FreeDentalConfig.xml)
od/scan-duplex.md	Open Dental — duplex ADF scanner captures only one side (TWAIN, Show TWAIN UI branches)
od/db-backup.md	Open Dental — rock-solid cold backup of the database + images (stop/copy/start MySQL/MariaDB)
od/backup-verify.md	Open Dental — verify a backup by test-restoring into an isolated Hyper-V VM (health checklist)
od/backup-schedule.md	Open Dental — schedule the backup + off-site upload and monitor it (dead-man's-switch heartbeat)

Security / incident response — sec/

File	Purpose
sec/google-compromise.md	Incident response — suspected compromise of a consumer Google/Gmail account (AiTM session theft; no Workspace admin console)
sec/google-evidence.md	Google/Gmail account — evidence capture before changes + re-entry check after a password reset (numbered, field-usable)

Scripts — scripts/

File	Purpose
scripts/cg-disable.ps1	Disable Credential Guard, then reboot (prompts to confirm)
scripts/od-cfg-acl.ps1	Grant Users Modify on FreeDentalConfig.xml (Option B of od-cfg-persist)
scripts/od-db-backup.ps1	Cold backup: stop MySQL/MariaDB, copy whole data dir + OpenDentImages, always restart (od-db-backup)
scripts/od-backup-check.ps1	Read-only backup health check: freshness/completeness/size + heartbeat ping (od-backup-schedule)

Tiers

• This repo (public): generic procedures, placeholders only.
• Private tier: filled-in, client-specific versions — private repo or Bitwarden secure notes. Never here.

This repo also serves as the raw source for Intune remediation scripts and as documented-procedures evidence for E&O / cyber insurance.