igodwin
cb0c5b4614
od-db-backup.md becomes od/db-backup.md -- the hyphen becomes a slash, so the fetch command is exactly as long to type as before. That mattered: the length of a hand-typed command is the constraint this repo is organized around, and a reorganization that lengthened it would have been a net loss. Scripts deliberately stay flat in scripts/ with their domain prefix. Everything executable in one directory is the set worth reading before it runs, and nesting five files by domain would add characters without adding clarity. Updates every reference: README Contents (now grouped by directory), the layout section, both fetch examples, inter-runbook links, and the .NOTES headers in all five scripts. Verified every markdown link resolves on disk and that Contents and the filesystem agree in both directions. Records the naming rule in CONTRIBUTING so the next file lands correctly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
4.8 KiB
Runbook: Open Dental SMB Share Access — Stored Credential Fix
For qualified IT professionals, on systems they are authorized to administer. Provided as-is, without warranty — verify it fits your environment. See LICENSE.
Applies to: Entra-joined Windows workstation accessing an Open Dental A-to-Z share on a standalone (non-domain, non-Entra) server via local SAM credentials.
Symptom: Open Dental cannot reach \\<SERVER>\<SHARE> after workstation restart; works after manually connecting via File Explorer.
Root causes covered: missing/stale stored Windows credential; Credential Guard blocking saved credential replay; elevated process not seeing user-session credentials.
Placeholders:
| Placeholder | Meaning |
|---|---|
<SERVER> |
Application server hostname |
<SHARE> |
Share name (e.g. OpenDentImages) |
<SHARE_USER> |
Local account on <SERVER> used for share access |
<PASSWORD> |
From password manager — never stored in this file |
1. Confirm identity of the machine
hostname
Verify you're on the machine you think you're on before changing anything.
2. Check Credential Guard status
msinfo32
System Summary → Virtualization-based security Services Running
- Credential Guard not listed → skip to Step 4
- Credential Guard listed → do Step 3
Context: Credential Guard blocks the replay of saved "Windows credentials" from Credential Manager. Symptom is exactly "works after manual Explorer connect, breaks on restart." Enabled by default on Windows 11 22H2+ on entitled SKUs (Enterprise/Business), not plain Pro.
3. Disable Credential Guard (ONLY if running)
Fastest, from an elevated PowerShell:
irm rb.godwinsystems.com/scripts/cg-disable.ps1 | iex
It confirms, clears the flags, and prompts to reboot.
Offline / manual equivalent (elevated PowerShell or Command Prompt):
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
shutdown /r /t 0
After reboot: re-run msinfo32 and confirm Credential Guard is no longer listed, then continue.
If it's still running after reboot, it was enabled with UEFI lock — requires the bcdedit/physical-presence removal procedure. Also check whether MDM policy is re-enabling it; align with the environment's baseline rather than fighting it locally.
4. Review existing stored credentials
Regular (NON-elevated) Command Prompt, logged in as the user who runs Open Dental:
cmdkey /list
- Record any entries for
<SERVER>(by hostname or IP) before deleting. - Delete existing entries for the server:
cmdkey /delete:<SERVER>
Repeat for IP-based entries if present. Duplicate entries for the same server (hostname + IP) cause intermittent 1219-style conflicts — clear all of them.
5. Add the credential
Same non-elevated prompt (elevated prompts write to the wrong credential vault):
cmdkey /add:<SERVER> /user:<SERVER>\<SHARE_USER> /pass:"<PASSWORD>"
Quote the password if it contains special characters.
6. Verify it stored
cmdkey /list
Expect an entry with Target: <SERVER>.
7. Cold test
shutdown /r /t 0
Log in as the Open Dental user. Launch Open Dental directly — do not open Explorer or touch the share first. Open the Imaging module → confirm images load.
PASS → done. Record results.
8. If Step 7 fails — isolate
dir \\<SERVER>\<SHARE>
| Result | Meaning | Action |
|---|---|---|
dir fails |
Stored credential not being used | cmdkey /list — confirm entry survived reboot; re-check msinfo32 for Credential Guard |
dir works, Open Dental doesn't |
Open Dental launching elevated | Shortcut → Properties → Advanced → uncheck "Run as administrator"; also check Compatibility tab. Retest. If elevation is required, set EnableLinkedConnections (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, DWORD=1) and reboot. |
Fleet comparison (optional, ~2 min)
On a known-working workstation:
cmdkey /list
Record what it stores for <SERVER> — documents the fleet's credential state and reveals inconsistencies (per-machine manual setups, stale accounts).
Notes
- The Open Dental A-to-Z path stored in Setup → Data Paths is global (database-stored). The "Path override for this computer" field is per-workstation. Never change the global path to a mapped drive letter to fix one machine.
- Prefer a dedicated low-privilege local account on
<SERVER>scoped to the share only — not an administrative account. - Rotating the share account's password silently breaks stored credentials on every workstation using it. Inventory which machines hold it (Step 4 on each) before rotating.