igodwin
6df8a53196
- Move _template.ps1 and cg-disable.ps1 into scripts/ - Update all fetch/run URLs and doc links to scripts/ paths - Rework README layout/naming section; add as-is/no-warranty disclaimer Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
135 lines
4.6 KiB
Markdown
135 lines
4.6 KiB
Markdown
# Runbook: Open Dental SMB Share Access — Stored Credential Fix
|
|
|
|
**Applies to:** Entra-joined Windows workstation accessing an Open Dental A-to-Z share on a standalone (non-domain, non-Entra) server via local SAM credentials.
|
|
**Symptom:** Open Dental cannot reach `\\<SERVER>\<SHARE>` after workstation restart; works after manually connecting via File Explorer.
|
|
**Root causes covered:** missing/stale stored Windows credential; Credential Guard blocking saved credential replay; elevated process not seeing user-session credentials.
|
|
|
|
**Placeholders:**
|
|
|
|
| Placeholder | Meaning |
|
|
|---|---|
|
|
| `<SERVER>` | Application server hostname |
|
|
| `<SHARE>` | Share name (e.g. OpenDentImages) |
|
|
| `<SHARE_USER>` | Local account on `<SERVER>` used for share access |
|
|
| `<PASSWORD>` | From password manager — never stored in this file |
|
|
|
|
---
|
|
|
|
## 1. Confirm identity of the machine
|
|
|
|
```
|
|
hostname
|
|
```
|
|
|
|
Verify you're on the machine you think you're on before changing anything.
|
|
|
|
## 2. Check Credential Guard status
|
|
|
|
```
|
|
msinfo32
|
|
```
|
|
|
|
System Summary → **Virtualization-based security Services Running**
|
|
|
|
- Credential Guard **not listed** → skip to Step 4
|
|
- Credential Guard **listed** → do Step 3
|
|
|
|
> Context: Credential Guard blocks the replay of saved "Windows credentials" from Credential Manager. Symptom is exactly "works after manual Explorer connect, breaks on restart." Enabled by default on Windows 11 22H2+ on entitled SKUs (Enterprise/Business), not plain Pro.
|
|
|
|
## 3. Disable Credential Guard (ONLY if running)
|
|
|
|
Fastest, from an **elevated** PowerShell:
|
|
|
|
```
|
|
irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/cg-disable.ps1 | iex
|
|
```
|
|
|
|
It confirms, clears the flags, and prompts to reboot.
|
|
|
|
Offline / manual equivalent (elevated PowerShell or Command Prompt):
|
|
|
|
```
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
|
|
shutdown /r /t 0
|
|
```
|
|
|
|
After reboot: re-run msinfo32 and confirm Credential Guard is no longer listed, then continue.
|
|
|
|
> If it's still running after reboot, it was enabled with UEFI lock — requires the bcdedit/physical-presence removal procedure. Also check whether MDM policy is re-enabling it; align with the environment's baseline rather than fighting it locally.
|
|
|
|
## 4. Review existing stored credentials
|
|
|
|
Regular (NON-elevated) Command Prompt, logged in as the user who runs Open Dental:
|
|
|
|
```
|
|
cmdkey /list
|
|
```
|
|
|
|
- Record any entries for `<SERVER>` (by hostname or IP) before deleting.
|
|
- Delete existing entries for the server:
|
|
|
|
```
|
|
cmdkey /delete:<SERVER>
|
|
```
|
|
|
|
Repeat for IP-based entries if present. Duplicate entries for the same server (hostname + IP) cause intermittent 1219-style conflicts — clear all of them.
|
|
|
|
## 5. Add the credential
|
|
|
|
Same non-elevated prompt (elevated prompts write to the wrong credential vault):
|
|
|
|
```
|
|
cmdkey /add:<SERVER> /user:<SERVER>\<SHARE_USER> /pass:"<PASSWORD>"
|
|
```
|
|
|
|
Quote the password if it contains special characters.
|
|
|
|
## 6. Verify it stored
|
|
|
|
```
|
|
cmdkey /list
|
|
```
|
|
|
|
Expect an entry with `Target: <SERVER>`.
|
|
|
|
## 7. Cold test
|
|
|
|
```
|
|
shutdown /r /t 0
|
|
```
|
|
|
|
Log in as the Open Dental user. Launch Open Dental **directly — do not open Explorer or touch the share first.**
|
|
Open the Imaging module → confirm images load.
|
|
|
|
**PASS → done.** Record results.
|
|
|
|
## 8. If Step 7 fails — isolate
|
|
|
|
```
|
|
dir \\<SERVER>\<SHARE>
|
|
```
|
|
|
|
| Result | Meaning | Action |
|
|
|---|---|---|
|
|
| `dir` fails | Stored credential not being used | `cmdkey /list` — confirm entry survived reboot; re-check msinfo32 for Credential Guard |
|
|
| `dir` works, Open Dental doesn't | Open Dental launching elevated | Shortcut → Properties → Advanced → uncheck "Run as administrator"; also check Compatibility tab. Retest. If elevation is required, set `EnableLinkedConnections` (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, DWORD=1) and reboot. |
|
|
|
|
## Fleet comparison (optional, ~2 min)
|
|
|
|
On a known-working workstation:
|
|
|
|
```
|
|
cmdkey /list
|
|
```
|
|
|
|
Record what it stores for `<SERVER>` — documents the fleet's credential state and reveals inconsistencies (per-machine manual setups, stale accounts).
|
|
|
|
---
|
|
|
|
## Notes
|
|
|
|
- The Open Dental A-to-Z path stored in Setup → Data Paths is **global** (database-stored). The "Path override for this computer" field is per-workstation. Never change the global path to a mapped drive letter to fix one machine.
|
|
- Prefer a dedicated low-privilege local account on `<SERVER>` scoped to the share only — not an administrative account.
|
|
- Rotating the share account's password silently breaks stored credentials on every workstation using it. Inventory which machines hold it (Step 4 on each) before rotating.
|