# Runbook: Open Dental SMB Share Access — Stored Credential Fix

**Applies to:** Entra-joined Windows workstation accessing an Open Dental A-to-Z share on a standalone (non-domain, non-Entra) server via local SAM credentials.
**Symptom:** Open Dental cannot reach `\\<SERVER>\<SHARE>` after workstation restart; works after manually connecting via File Explorer.
**Root causes covered:** missing/stale stored Windows credential; Credential Guard blocking saved credential replay; elevated process not seeing user-session credentials.

**Placeholders:**

| Placeholder | Meaning |
|---|---|
| `<SERVER>` | Application server hostname |
| `<SHARE>` | Share name (e.g. OpenDentImages) |
| `<SHARE_USER>` | Local account on `<SERVER>` used for share access |
| `<PASSWORD>` | From password manager — never stored in this file |

---

## 1. Confirm identity of the machine

```
hostname
```

Verify you're on the machine you think you're on before changing anything.

## 2. Check Credential Guard status

```
msinfo32
```

System Summary → **Virtualization-based security Services Running**

- Credential Guard **not listed** → skip to Step 4
- Credential Guard **listed** → do Step 3

> Context: Credential Guard blocks the replay of saved "Windows credentials" from Credential Manager. Symptom is exactly "works after manual Explorer connect, breaks on restart." Enabled by default on Windows 11 22H2+ on entitled SKUs (Enterprise/Business), not plain Pro.

## 3. Disable Credential Guard (ONLY if running)

Fastest, from an **elevated** PowerShell:

```
irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/cg-disable.ps1 | iex
```

It confirms, clears the flags, and prompts to reboot.

Offline / manual equivalent (elevated PowerShell or Command Prompt):

```
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
shutdown /r /t 0
```

After reboot: re-run msinfo32 and confirm Credential Guard is no longer listed, then continue.

> If it's still running after reboot, it was enabled with UEFI lock — requires the bcdedit/physical-presence removal procedure. Also check whether MDM policy is re-enabling it; align with the environment's baseline rather than fighting it locally.

## 4. Review existing stored credentials

Regular (NON-elevated) Command Prompt, logged in as the user who runs Open Dental:

```
cmdkey /list
```

- Record any entries for `<SERVER>` (by hostname or IP) before deleting.
- Delete existing entries for the server:

```
cmdkey /delete:<SERVER>
```

Repeat for IP-based entries if present. Duplicate entries for the same server (hostname + IP) cause intermittent 1219-style conflicts — clear all of them.

## 5. Add the credential

Same non-elevated prompt (elevated prompts write to the wrong credential vault):

```
cmdkey /add:<SERVER> /user:<SERVER>\<SHARE_USER> /pass:"<PASSWORD>"
```

Quote the password if it contains special characters.

## 6. Verify it stored

```
cmdkey /list
```

Expect an entry with `Target: <SERVER>`.

## 7. Cold test

```
shutdown /r /t 0
```

Log in as the Open Dental user. Launch Open Dental **directly — do not open Explorer or touch the share first.**
Open the Imaging module → confirm images load.

**PASS → done.** Record results.

## 8. If Step 7 fails — isolate

```
dir \\<SERVER>\<SHARE>
```

| Result | Meaning | Action |
|---|---|---|
| `dir` fails | Stored credential not being used | `cmdkey /list` — confirm entry survived reboot; re-check msinfo32 for Credential Guard |
| `dir` works, Open Dental doesn't | Open Dental launching elevated | Shortcut → Properties → Advanced → uncheck "Run as administrator"; also check Compatibility tab. Retest. If elevation is required, set `EnableLinkedConnections` (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, DWORD=1) and reboot. |

## Fleet comparison (optional, ~2 min)

On a known-working workstation:

```
cmdkey /list
```

Record what it stores for `<SERVER>` — documents the fleet's credential state and reveals inconsistencies (per-machine manual setups, stale accounts).

---

## Notes

- The Open Dental A-to-Z path stored in Setup → Data Paths is **global** (database-stored). The "Path override for this computer" field is per-workstation. Never change the global path to a mapped drive letter to fix one machine.
- Prefer a dedicated low-privilege local account on `<SERVER>` scoped to the share only — not an administrative account.
- Rotating the share account's password silently breaks stored credentials on every workstation using it. Inventory which machines hold it (Step 4 on each) before rotating.