rb/od-smb-cred.md

Runbook: Open Dental SMB Share Access — Stored Credential Fix

Applies to: Entra-joined Windows workstation accessing an Open Dental A-to-Z share on a standalone (non-domain, non-Entra) server via local SAM credentials. Symptom: Open Dental cannot reach \\<SERVER>\<SHARE> after workstation restart; works after manually connecting via File Explorer. Root causes covered: missing/stale stored Windows credential; Credential Guard blocking saved credential replay; elevated process not seeing user-session credentials.

Placeholders:

Placeholder	Meaning
<SERVER>	Application server hostname
<SHARE>	Share name (e.g. OpenDentImages)
<SHARE_USER>	Local account on <SERVER> used for share access
<PASSWORD>	From password manager — never stored in this file

---

1. Confirm identity of the machine

hostname

Verify you're on the machine you think you're on before changing anything.

2. Check Credential Guard status

msinfo32

System Summary → Virtualization-based security Services Running

• Credential Guard not listed → skip to Step 4
• Credential Guard listed → do Step 3

Context: Credential Guard blocks the replay of saved "Windows credentials" from Credential Manager. Symptom is exactly "works after manual Explorer connect, breaks on restart." Enabled by default on Windows 11 22H2+ on entitled SKUs (Enterprise/Business), not plain Pro.

3. Disable Credential Guard (ONLY if running)

Fastest, from an elevated PowerShell:

irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/cg-disable.ps1 | iex

It confirms, clears the flags, and prompts to reboot.

Offline / manual equivalent (elevated PowerShell or Command Prompt):

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
shutdown /r /t 0

After reboot: re-run msinfo32 and confirm Credential Guard is no longer listed, then continue.

If it's still running after reboot, it was enabled with UEFI lock — requires the bcdedit/physical-presence removal procedure. Also check whether MDM policy is re-enabling it; align with the environment's baseline rather than fighting it locally.

4. Review existing stored credentials

Regular (NON-elevated) Command Prompt, logged in as the user who runs Open Dental:

cmdkey /list

• Record any entries for <SERVER> (by hostname or IP) before deleting.
• Delete existing entries for the server:

cmdkey /delete:<SERVER>

Repeat for IP-based entries if present. Duplicate entries for the same server (hostname + IP) cause intermittent 1219-style conflicts — clear all of them.

5. Add the credential

Same non-elevated prompt (elevated prompts write to the wrong credential vault):

cmdkey /add:<SERVER> /user:<SERVER>\<SHARE_USER> /pass:"<PASSWORD>"

Quote the password if it contains special characters.

6. Verify it stored

cmdkey /list

Expect an entry with Target: <SERVER>.

7. Cold test

shutdown /r /t 0

Log in as the Open Dental user. Launch Open Dental directly — do not open Explorer or touch the share first. Open the Imaging module → confirm images load.

PASS → done. Record results.

8. If Step 7 fails — isolate

dir \\<SERVER>\<SHARE>

Result	Meaning	Action
dir fails	Stored credential not being used	cmdkey /list — confirm entry survived reboot; re-check msinfo32 for Credential Guard
dir works, Open Dental doesn't	Open Dental launching elevated	Shortcut → Properties → Advanced → uncheck "Run as administrator"; also check Compatibility tab. Retest. If elevation is required, set EnableLinkedConnections (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, DWORD=1) and reboot.

Fleet comparison (optional, ~2 min)

On a known-working workstation:

cmdkey /list

Record what it stores for <SERVER> — documents the fleet's credential state and reveals inconsistencies (per-machine manual setups, stale accounts).

---

Notes

• The Open Dental A-to-Z path stored in Setup → Data Paths is global (database-stored). The "Path override for this computer" field is per-workstation. Never change the global path to a mapped drive letter to fix one machine.
• Prefer a dedicated low-privilege local account on <SERVER> scoped to the share only — not an administrative account.
• Rotating the share account's password silently breaks stored credentials on every workstation using it. Inventory which machines hold it (Step 4 on each) before rotating.