Add od-cfg-persist runbook + od-cfg-acl script

Persist Open Dental's 'Do not show this window on startup' by making
FreeDentalConfig.xml writable:
- Option A: one-time elevated save
- Option B (preferred): grant Users Modify via well-known SID S-1-5-32-545
- od-cfg-acl.ps1 auto-resolves 64/32-bit install path, iex-safe conventions
- Security note on reversible MySQL password in the config; limited user / Middle Tier
- Cites OD manual freedentalconfig.html / choosedatabase.html

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

od-cfg-persist.md

@@ -0,0 +1,78 @@
+# Runbook: Open Dental — Persist "Do not show this window on startup"
+
+**Applies to:** Windows workstation where Open Dental is run by a standard (non-admin) user.
+**Symptom:** The **Choose Database** window appears on every launch even though **"Do not show this window on startup (this computer only)"** is checked. The checkbox appears to take but does not survive a restart.
+**Root cause:** The setting is stored in `FreeDentalConfig.xml` in the Open Dental install directory. Standard users lack write permission to that directory, so the change is never saved. Per Open Dental's docs, saving this window's settings requires the process to write that file.
+
+**Placeholders:**
+
+| Placeholder | Meaning |
+|---|---|
+| `<OD_INSTALL_DIR>` | Open Dental install directory (holds `FreeDentalConfig.xml`) — commonly under `Program Files` or `Program Files (x86)`; varies by version/architecture |
+
+---
+
+## 1. Confirm the symptom
+
+Launch Open Dental **as the standard user who normally runs it**. Check **"Do not show this window on startup (this computer only)"**, click **OK**, then fully close and relaunch.
+
+- Window returns → the config file isn't being saved → continue.
+- Window gone → nothing to do.
+
+## 2. Choose the fix
+
+| Situation | Use |
+|---|---|
+| One-off machine, or the daily user is already a local admin | **Option A** — one-time elevated save |
+| Shared workstation, or the daily user is a standard (non-admin) user | **Option B** — persistent ACL grant *(preferred)* |
+
+Option A saves the setting once under an elevated context. Option B makes the file writable under the normal user context so Open Dental can rewrite it itself, now and after future changes — the durable fix for standard-user machines.
+
+## 3. Option A — One-time elevated save
+
+1. Right-click the Open Dental shortcut → **Run as administrator**.
+2. Re-check **"Do not show this window on startup (this computer only)."**
+3. Click **OK**, then close Open Dental.
+4. Relaunch **as the standard user** and confirm the window no longer appears.
+
+> Because the elevated process could write the install directory, the setting saves. If the standard user later triggers another change to this window, it won't persist — for shared/standard-user machines prefer Option B.
+
+## 4. Option B — Persistent ACL grant (preferred)
+
+Grant the built-in **Users** group **Modify** on `FreeDentalConfig.xml` so Open Dental can rewrite it under the normal user context without elevation.
+
+Fastest, from an **elevated** PowerShell:
+
+```
+irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/od-cfg-acl.ps1 | iex
+```
+
+It resolves the install path (64-bit / 32-bit Program Files), confirms, and grants the permission.
+
+Offline / manual equivalent (elevated PowerShell or Command Prompt) — grant Modify to Users via the well-known SID, not the localized name "Users":
+
+```
+icacls "<OD_INSTALL_DIR>\FreeDentalConfig.xml" /grant *S-1-5-32-545:M
+```
+
+> `S-1-5-32-545` is the built-in **Users** group on every Windows install regardless of OS language — safer in scripts than the display name "Users," which is localized. `:M` = Modify.
+
+## 5. Verify
+
+Relaunch Open Dental **as the standard user**. Confirm the **Choose Database** window no longer appears on startup.
+
+If it still appears: confirm the ACL landed with `icacls "<OD_INSTALL_DIR>\FreeDentalConfig.xml"` (look for a `Users:(M)`-style entry), and confirm you edited the copy in the directory Open Dental actually launches from.
+
+---
+
+## Security note
+
+On **direct-connection** setups, `FreeDentalConfig.xml` stores the MySQL password **obfuscated but reversible**. Granting the Users group write access does not change that exposure — but widening read/write on a file that holds DB credentials is worth calling out.
+
+- Use a **limited MySQL user** (scoped to the Open Dental database) for workstation connections rather than `root`.
+- Longer-term, move to **Middle Tier**, which removes per-workstation DB credentials entirely (workstations talk to a service, not the database directly).
+
+## References
+
+- Open Dental manual — FreeDentalConfig.xml: <https://www.opendental.com/manual/freedentalconfig.html>
+- Open Dental manual — Choose Database window: <https://www.opendental.com/manual/choosedatabase.html>