igodwin
55b6fd73b8
Persist Open Dental's 'Do not show this window on startup' by making FreeDentalConfig.xml writable: - Option A: one-time elevated save - Option B (preferred): grant Users Modify via well-known SID S-1-5-32-545 - od-cfg-acl.ps1 auto-resolves 64/32-bit install path, iex-safe conventions - Security note on reversible MySQL password in the config; limited user / Middle Tier - Cites OD manual freedentalconfig.html / choosedatabase.html Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
65 lines
2.9 KiB
PowerShell
65 lines
2.9 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Grant the built-in Users group Modify on Open Dental's FreeDentalConfig.xml
|
|
so the "Do not show this window on startup" setting persists for standard
|
|
users.
|
|
|
|
.DESCRIPTION
|
|
Open Dental stores the Choose Database window's "do not show on startup"
|
|
setting in FreeDentalConfig.xml in the install directory. Standard (non-admin)
|
|
users lack write permission there, so the checkbox never saves and the window
|
|
returns on every launch. This grants the built-in Users group Modify on that
|
|
one file, using the well-known SID (locale-independent).
|
|
|
|
Auto-resolves the install directory across 64-bit / 32-bit Program Files;
|
|
fails clearly if FreeDentalConfig.xml isn't found in either.
|
|
|
|
.NOTES
|
|
Run via: irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/od-cfg-acl.ps1 | iex
|
|
Referenced by od-cfg-persist.md, Option B.
|
|
|
|
SECURITY: on direct-connection setups FreeDentalConfig.xml also holds the
|
|
MySQL password (obfuscated but reversible). Widening write access here does
|
|
not change that exposure, but prefer a limited MySQL user over root for
|
|
workstation connections, and Middle Tier as the long-term fix that removes
|
|
per-workstation DB credentials entirely. See the runbook's security note.
|
|
#>
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
# --- Admin check (do not rely on #Requires under iex) ---
|
|
$isAdmin = ([Security.Principal.WindowsPrincipal] `
|
|
[Security.Principal.WindowsIdentity]::GetCurrent()
|
|
).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
|
|
if (-not $isAdmin) {
|
|
Write-Warning 'This script needs an elevated PowerShell session. Re-run as Administrator.'
|
|
return
|
|
}
|
|
|
|
Write-Host '== Open Dental: make FreeDentalConfig.xml writable by Users ==' -ForegroundColor Cyan
|
|
|
|
# --- Resolve install path across 64-bit / 32-bit Program Files ---
|
|
$bases = @(${env:ProgramFiles(x86)}, $env:ProgramFiles) | Where-Object { $_ }
|
|
$candidates = $bases | ForEach-Object { Join-Path $_ 'Open Dental\FreeDentalConfig.xml' }
|
|
$configPath = $candidates | Where-Object { Test-Path $_ } | Select-Object -First 1
|
|
if (-not $configPath) {
|
|
Write-Warning "FreeDentalConfig.xml not found. Checked:`n $($candidates -join "`n ")"
|
|
Write-Warning 'If Open Dental is installed elsewhere, grant Users Modify on that copy manually.'
|
|
return
|
|
}
|
|
|
|
Write-Host "Found: $configPath" -ForegroundColor Green
|
|
Write-Host 'About to grant the built-in Users group (S-1-5-32-545) Modify on this file.' -ForegroundColor Yellow
|
|
if ((Read-Host 'Proceed? (y/N)') -ne 'y') {
|
|
Write-Host 'Aborted. No changes made.'
|
|
return
|
|
}
|
|
|
|
# --- Grant Modify to Users via well-known SID (not the localized name "Users") ---
|
|
icacls "$configPath" /grant '*S-1-5-32-545:M'
|
|
if ($LASTEXITCODE -ne 0) {
|
|
Write-Warning "icacls returned exit code $LASTEXITCODE — permission not changed."
|
|
return
|
|
}
|
|
Write-Host 'Done. Relaunch Open Dental as the standard user to confirm the window is gone.' -ForegroundColor Green
|