Securing Dentrix, Eaglesoft, and Open Dental: A Practical Hardening Guide

Dental practice management software runs the practice. It holds the schedule, the chart, the imaging links, the insurance data, and the billing. It is also one of the least-hardened pieces of software in a typical small business, because the people who install it are trained on workflow — not on Windows server hardening, SQL Server defaults, or HIPAA-grade audit logging.

This is a practitioner guide for the three systems I see most often in the field: Dentrix, Eaglesoft, and Open Dental. The vendors document features; they do not really document security configuration. The defaults are not secure, and the defaults are what most practices are running.

Why a hardening guide is necessary in the first place

Every PMS vendor publishes an install guide. None of them publishes a security baseline that a regulator or a cyber insurer would recognize. The install guide tells you how to get the software running. It does not tell you to rotate the SQL Server sa password, disable interactive logins for service accounts, segment the imaging share, enable per-user accounts, or test your restores.

That gap is what attackers walk through. Ransomware operators do not need a zero-day to encrypt a dental practice — they need a port-forwarded RDP, a shared FrontDesk account, and a USB backup drive plugged in 24/7. All three are standard.

Account hygiene — the single biggest problem

The most common finding on a dental assessment is a shared FrontDesk1 account (or Reception, or Office) logged into the reception desktop, with PMS administrator rights, and four people using it throughout the day.

That single configuration breaks several things at once:

• HIPAA workforce access management under 45 CFR 164.308(a)(4) requires that access to ePHI be assignable and revocable by workforce member. A shared login satisfies neither.
• The audit log becomes useless. Every action gets attributed to "FrontDesk1." You cannot answer "who deleted this appointment?" or "who exported this patient list?"
• Offboarding is impossible. When the hygienist who knew the password leaves, you would have to rotate it and retrain everyone. Most practices skip that step.

Every PMS in this category supports per-user accounts. Dentrix has user accounts with role-based passwords. Eaglesoft has per-user logins with security rights. Open Dental has a full user/group/permission model. The work is enabling them, training staff to lock the workstation when they walk away (Win+L), and shortening the PMS auto-logout to five to ten minutes at the front desk. Do this before anything else on this list — most of the controls below depend on it.

The SQL Server and database layer

The piece most office managers — and many MSPs — do not realize: the PMS is just a front end. The real prize for an attacker is the database.

Dentrix and Eaglesoft (Microsoft SQL Server)

Both Dentrix and Eaglesoft run on Microsoft SQL Server, typically Standard Edition on a dedicated server and Express on smaller installs. The default sa (system administrator) account is set during installation. On older installations it is set to a weak, well-known, or vendor-default value. Anyone with network access to the SQL listener and that password owns the entire patient database.

The fixes:

• Rotate the sa password to a long, random string stored in a password manager.
• Disable interactive use of sa. Create named SQL accounts for the PMS service and any DBA-style maintenance.
• Bind SQL Server only to the local network interface required by the PMS. There is no reason for the listener to be reachable from outside the practice LAN.
• Patch SQL Server itself. Patterson's documentation on Eaglesoft has improved, but defaults persist on older installs that were upgraded in place rather than rebuilt.

Open Dental (MySQL / MariaDB)

Open Dental ships with a MySQL or MariaDB backend. The same problem exists with different account names:

• The MySQL root account must have a strong, rotated password.
• The default opendental database user must also be set — not left at the documented default.
• The MySQL listener (TCP 3306 by default) must be firewalled to the LAN, not exposed to the internet.

If you are running Open Dental and you can run telnet your.public.ip 3306 from outside the office and get a connection, stop reading and fix that first.

The PMS server itself

The PMS server is a Windows machine that holds patient data. It should be treated like a server — even when, as is increasingly common in small practices, the "server" is a Windows 11 Pro desktop sitting under the front desk acting as one. (That configuration is unsupported by Microsoft for multi-user database hosting and is its own risk; budget for a proper Windows Server or a cloud move.)

Baseline:

• Run a supported Windows Server release where possible (2019 or 2022 at time of writing). Consider Server Core for the PMS role if the vendor supports it.
• Disable interactive RDP from outside the LAN. If remote admin is needed, put it behind an RDP gateway with MFA, or use a zero-trust remote-access tool.
• Install EDR on the server. Most MSPs skip the server because "it is not a workstation." That is exactly backwards — the server is where the data is. We deploy Huntress Managed EDR on the PMS server and every workstation.
• Disable SMBv1, require SMB signing, and remove default administrative shares (C$, ADMIN$) from anywhere they are not strictly required.
• No daily-driver web browsing from the PMS server. Ever.

Remote access — the wrong way and the right way

Remote access is where most dental practices get breached. The wrong patterns are very consistent:

• TeamViewer or AnyDesk installed unattended on the PMS server with a static password and no MFA.
• RDP port-forwarded from the public IP to the server on TCP 3389 because "the doctor needs to check the schedule from home."
• A shared MSP RMM agent with no per-technician audit trail.

The right patterns are not exotic:

• Microsoft Entra ID with conditional access on the doctor's home laptop, requiring a compliant device and MFA before any remote session starts.
• MFA on every remote session, not just the first one of the day.
• Time-boxed, just-in-time access for the IT vendor — granted when work is scheduled, revoked when it is done, with the session recorded.
• No port-forwarded RDP from the internet. None. Use an RDP gateway, a VPN with MFA, or a zero-trust broker.

If you only do one thing this quarter, remove the port-forwarded RDP and the unattended TeamViewer.

Audit logging — every PMS has it; almost no one looks

Every PMS in this category has an audit log. Most practices have never opened it.

• Dentrix: Practice Information then Audit Log.
• Eaglesoft: Reports then Audit Trail.
• Open Dental: Setup then User Audit Trail (also surfaced inside individual patient records).

Review the log at least monthly. Specifically look for:

• After-hours access. Logins at 2 a.m. on a Sunday are worth a phone call.
• Deleted appointments. Repeated appointment deletion by the same user is a leading indicator of front-desk fraud — a known pattern in dental embezzlement cases.
• Patient-record exports and large report runs. Especially in the days before an employee departure.
• Permission changes. Anyone who granted themselves more rights than they had yesterday.

This review takes thirty minutes a month once you know what to look for. It is the cheapest control on this list.

Backup strategy — 3-2-1-1-0

The classic 3-2-1 backup rule is not enough in a ransomware-active threat model. The version I use for dental practices is 3-2-1-1-0:

• 3 copies of the data.
• 2 different media types.
• 1 copy offsite.
• 1 copy immutable — S3 Object Lock, Backblaze B2 Object Lock, Wasabi compliance mode, or equivalent. Ransomware that gets domain admin cannot delete what it cannot mutate.
• 0 errors on verification. Test the restore.

What I see in the field instead: a single USB drive plugged into the PMS server 24/7, running a nightly copy of the database file. When ransomware hits the server, it encrypts the USB drive at the same time. The practice now has no backups.

Test a restore monthly. Pick a non-production machine, restore last night's backup, open the database, confirm you can read a recent patient record. Any practice that has not tested a restore in six months is operating on hope, not on a backup strategy.

Imaging integration — the file share attackers hit first

Digital X-ray (Sirona/Schick, Carestream, Dexis), CBCT, and intraoral cameras almost always write images to a shared folder on the server. That folder is the second-highest-value target for ransomware after the PMS database, because encrypting it stops the practice from operating today — not just billing tomorrow.

Two specific problems:

1. The imaging share is usually wide open. Everyone in the practice has read/write access. Lock it down to the accounts and machines that actually need it.
2. Imaging vendors frequently ask you to disable Windows Defender for "compatibility." Push back hard. The right answer is narrow, documented EDR exclusions for the specific imaging process paths — not turning off endpoint protection on the machine that holds your X-rays.

If your imaging vendor's support tech tells you to disable AV entirely, get that in writing and then get a different recommendation from your security provider.

The patching problem nobody wants to talk about

The awkward truth: dental PMS vendors have historically lagged on supporting current Windows releases. It is not unusual for a major Windows version to ship and for Eaglesoft or Dentrix to take 12 to 24 months to formally certify it. That forces practices into a bad choice between running an unsupported OS and breaking PMS compatibility.

The honest controls when you cannot patch on Microsoft's timeline:

• Subscribe to the vendor's release notes and certification matrix. Know when they support what.
• Set a quarterly compatibility review on the calendar.
• Document the risk acceptance when you have to stay on an older Windows build. Your cyber insurer will ask.
• Compensate with stronger controls elsewhere — EDR on every machine, managed identity threat detection on Microsoft 365 or Google Workspace, network segmentation between the PMS server and the rest of the office network, and reviewed audit logs.

This is the part of the conversation that practice owners find frustrating. It is also where having a security provider who will document the tradeoff is worth the line item.

Cloud-hosted alternatives — Curve, Denticon, Dentrix Cloud

A growing share of practices are moving off on-prem PMS entirely. Curve Dental, Denticon, and Dentrix Cloud all shift the server-hardening burden to the vendor. That is a real benefit, especially for single-location practices that cannot justify the IT overhead of a hardened on-prem server.

It does not remove your risk. It changes it:

• The dominant threat becomes account compromise — phishing for the front-desk Microsoft 365 password, then logging into the cloud PMS portal.
• You need a signed BAA with the vendor before any patient data goes near it.
• You need identity-layer monitoring on the Microsoft 365 or Google Workspace tenant that fronts those accounts. Managed ITDR covers this gap.
• You need MFA on every account that touches the PMS, the email, and the password manager.

Cloud is not a security strategy. Cloud plus identity monitoring plus MFA is.

Where Obsidian Ridge fits

When we onboard a dental practice, the typical sequence is straightforward:

• Deploy Huntress Managed EDR on the PMS server and every workstation, including imaging stations.
• Deploy Huntress Managed ITDR on the practice's Microsoft 365 or Google Workspace tenant.
• Where applicable, layer managed SIEM for log retention and audit-trail correlation.
• Rotate the SQL Server sa (Dentrix/Eaglesoft) or MySQL root (Open Dental) credentials and remove interactive use.
• Enable per-user PMS accounts and a monthly audit-log review cadence.
• Replace port-forwarded RDP and unattended TeamViewer with MFA-gated remote access.
• Rebuild the backup to 3-2-1-1-0 with one immutable copy and a tested monthly restore.

None of that is exotic. All of it is the difference between a practice that recovers from an incident in a week and a practice that pays a ransom, notifies patients, and explains itself to its state dental board.

If you run a dental practice and you are not sure where you stand against this list, book an assessment. We will walk through your PMS configuration, your backups, your remote-access path, and your audit logs, and tell you honestly what to fix first.