igodwin
f2a979f047
The repo is public and files are fetched by raw URL, so a reader who lands on one runbook never sees the README -- the repo's context does not travel with the file. Each .md now carries two lines under the title, each .ps1 the equivalent at the end of its .NOTES block. Deliberately two lines, not a paragraph. These files are read through `| more` on a client console mid-incident, and the top of the file is where the procedure-specific warnings live -- never a live chart, stop the service before copying, confirm authorization before acting. A legal preamble above those competes with them and trains people to skip past. Wording aims at a stranger who found the repo, not at the quality of the procedure: these double as documented-procedure evidence for E&O, and language implying the content is unreliable works against that. MIT rather than no license: the warranty and liability disclaimer is the part that does the work, and leaving it unlicensed makes reuse ambiguous rather than disclaimed. Also fixes 5 stale ops/rb URLs in scripts/*.ps1 that the previous commit missed -- it only swept the .md files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
138 lines
4.8 KiB
Markdown
138 lines
4.8 KiB
Markdown
# Runbook: Open Dental SMB Share Access — Stored Credential Fix
|
|
|
|
> For qualified IT professionals, on systems they are authorized to administer.
|
|
> Provided as-is, without warranty — verify it fits your environment. See LICENSE.
|
|
|
|
**Applies to:** Entra-joined Windows workstation accessing an Open Dental A-to-Z share on a standalone (non-domain, non-Entra) server via local SAM credentials.
|
|
**Symptom:** Open Dental cannot reach `\\<SERVER>\<SHARE>` after workstation restart; works after manually connecting via File Explorer.
|
|
**Root causes covered:** missing/stale stored Windows credential; Credential Guard blocking saved credential replay; elevated process not seeing user-session credentials.
|
|
|
|
**Placeholders:**
|
|
|
|
| Placeholder | Meaning |
|
|
|---|---|
|
|
| `<SERVER>` | Application server hostname |
|
|
| `<SHARE>` | Share name (e.g. OpenDentImages) |
|
|
| `<SHARE_USER>` | Local account on `<SERVER>` used for share access |
|
|
| `<PASSWORD>` | From password manager — never stored in this file |
|
|
|
|
---
|
|
|
|
## 1. Confirm identity of the machine
|
|
|
|
```
|
|
hostname
|
|
```
|
|
|
|
Verify you're on the machine you think you're on before changing anything.
|
|
|
|
## 2. Check Credential Guard status
|
|
|
|
```
|
|
msinfo32
|
|
```
|
|
|
|
System Summary → **Virtualization-based security Services Running**
|
|
|
|
- Credential Guard **not listed** → skip to Step 4
|
|
- Credential Guard **listed** → do Step 3
|
|
|
|
> Context: Credential Guard blocks the replay of saved "Windows credentials" from Credential Manager. Symptom is exactly "works after manual Explorer connect, breaks on restart." Enabled by default on Windows 11 22H2+ on entitled SKUs (Enterprise/Business), not plain Pro.
|
|
|
|
## 3. Disable Credential Guard (ONLY if running)
|
|
|
|
Fastest, from an **elevated** PowerShell:
|
|
|
|
```
|
|
irm rb.godwinsystems.com/scripts/cg-disable.ps1 | iex
|
|
```
|
|
|
|
It confirms, clears the flags, and prompts to reboot.
|
|
|
|
Offline / manual equivalent (elevated PowerShell or Command Prompt):
|
|
|
|
```
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
|
|
shutdown /r /t 0
|
|
```
|
|
|
|
After reboot: re-run msinfo32 and confirm Credential Guard is no longer listed, then continue.
|
|
|
|
> If it's still running after reboot, it was enabled with UEFI lock — requires the bcdedit/physical-presence removal procedure. Also check whether MDM policy is re-enabling it; align with the environment's baseline rather than fighting it locally.
|
|
|
|
## 4. Review existing stored credentials
|
|
|
|
Regular (NON-elevated) Command Prompt, logged in as the user who runs Open Dental:
|
|
|
|
```
|
|
cmdkey /list
|
|
```
|
|
|
|
- Record any entries for `<SERVER>` (by hostname or IP) before deleting.
|
|
- Delete existing entries for the server:
|
|
|
|
```
|
|
cmdkey /delete:<SERVER>
|
|
```
|
|
|
|
Repeat for IP-based entries if present. Duplicate entries for the same server (hostname + IP) cause intermittent 1219-style conflicts — clear all of them.
|
|
|
|
## 5. Add the credential
|
|
|
|
Same non-elevated prompt (elevated prompts write to the wrong credential vault):
|
|
|
|
```
|
|
cmdkey /add:<SERVER> /user:<SERVER>\<SHARE_USER> /pass:"<PASSWORD>"
|
|
```
|
|
|
|
Quote the password if it contains special characters.
|
|
|
|
## 6. Verify it stored
|
|
|
|
```
|
|
cmdkey /list
|
|
```
|
|
|
|
Expect an entry with `Target: <SERVER>`.
|
|
|
|
## 7. Cold test
|
|
|
|
```
|
|
shutdown /r /t 0
|
|
```
|
|
|
|
Log in as the Open Dental user. Launch Open Dental **directly — do not open Explorer or touch the share first.**
|
|
Open the Imaging module → confirm images load.
|
|
|
|
**PASS → done.** Record results.
|
|
|
|
## 8. If Step 7 fails — isolate
|
|
|
|
```
|
|
dir \\<SERVER>\<SHARE>
|
|
```
|
|
|
|
| Result | Meaning | Action |
|
|
|---|---|---|
|
|
| `dir` fails | Stored credential not being used | `cmdkey /list` — confirm entry survived reboot; re-check msinfo32 for Credential Guard |
|
|
| `dir` works, Open Dental doesn't | Open Dental launching elevated | Shortcut → Properties → Advanced → uncheck "Run as administrator"; also check Compatibility tab. Retest. If elevation is required, set `EnableLinkedConnections` (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, DWORD=1) and reboot. |
|
|
|
|
## Fleet comparison (optional, ~2 min)
|
|
|
|
On a known-working workstation:
|
|
|
|
```
|
|
cmdkey /list
|
|
```
|
|
|
|
Record what it stores for `<SERVER>` — documents the fleet's credential state and reveals inconsistencies (per-machine manual setups, stale accounts).
|
|
|
|
---
|
|
|
|
## Notes
|
|
|
|
- The Open Dental A-to-Z path stored in Setup → Data Paths is **global** (database-stored). The "Path override for this computer" field is per-workstation. Never change the global path to a mapped drive letter to fix one machine.
|
|
- Prefer a dedicated low-privilege local account on `<SERVER>` scoped to the share only — not an administrative account.
|
|
- Rotating the share account's password silently breaks stored credentials on every workstation using it. Inventory which machines hold it (Step 4 on each) before rotating.
|