Install the data service

The data service is set up as a Windows service with an installation program. It asks for the operating mode, service account, folders, certificate, post-quantum protection, and access, checks the information, and sets everything up. It doesn't create people, keys, or data sources; that happens afterwards.

There are two files of the same version:

Both set up the same things: the program dbgwsvc.exe under %ProgramFiles%\Wkl\Data Gateway, the Windows service Wkl.Data.Gateway (automatic start), the data folder %ProgramData%\Wkl.Data.Gateway with the administration store and a randomly generated master key (readable only by administrators and the service account), the configuration file, the certificate, the firewall rule, and two Start menu entries („Create the first administrator“, „Get a certificate from Let's Encrypt“; in German and Slovenian under their names in that language).

Prerequisites: 64-bit Windows 10 or 11, or Windows Server 2016 or later; administrator rights (the program asks through User Account Control during installation). No .NET runtime is needed; the package brings it along.

1. Start Wkl.Data.Gateway-Setup-<version>.exe. In Select language, choose German, English, or Slovenian and select OK; the list is preset to the Windows display language. The pages and their messages are then in that language. The pictures on this page show the German pages.

   

2. License: the license terms of EMSR DATA, in German, English, or Slovenian. The English version is legally binding. You can continue only after you select I accept the license terms. The same texts are in the program folder after installation (LICENSE.md, LICENSE.de.md, LICENSE.sl.md).

3. Requirements: the program checks Windows, rights, ports 8433 and 8434, IIS, and the certificates in the computer's store. You can continue as long as nothing is red.

   

4. Operating mode: at the top is the Installation name, suggested as „Data service (computer name)“ (in German „Datendienst (…)“, in Slovenian „Podatkovni prehod (…)“). The authenticator app lists every person's second factor under this name, such as „Data service (production): Jane Doe“. Choose it so that test and production, or two customers, can be told apart (at most 64 characters, no colon or quotation marks). You can change it later under Change or in the administration app (see „Set up or reset the second factor“ (documentation of the administration app)). A new name applies only to newly set up apps; existing entries keep their name.
   • Standalone Windows service (default): the service accepts HTTPS itself, on the HTTPS port (default 8433, modeled on SQL Server's 1433). The HTTP port (default 8434) responds only on this computer, for tools and the health probe.

   • Behind IIS (reverse proxy): IIS accepts port 443 and forwards to the service on 127.0.0.1. See Notes.

     Unencrypted HTTP only for development and testing. Port 8434 accepts requests without encryption; keys and passwords would travel there in plain text. That's why it responds only on this computer. Workstations—driver, Excel, Power BI, administration app—always connect over HTTPS (8433, or 443 behind IIS); on the server itself, 8434 is intended only for testing, the health probe, and emergencies.

     If a port is occupied, the program marks it red and lets you continue only once you enter a free port:

     

     With free ports:

     

5. Service account: the virtual account NT SERVICE\Wkl.Data.Gateway (default) or a group managed service account (DOMAIN\name$). An account with a password isn't offered. Data sources with integrated security sign in to SQL Server under this account; it needs a login there. If SQL Server runs on another computer, it sees the virtual account as the server's computer account (DOMAIN\COMPUTER$); that account then needs the login.

   

6. SQL Server: data sources with integrated security need a login for the service account in SQL Server and a user in each database; until then they fail with 18456 or 4060.
   • Don't create: the database administrators set up both themselves (see Notes).
   • Save a script (default): the program writes dienstkonto-anmeldung.sql to the data folder. The database administrators run it, for example with sqlcmd -S <server> -E -i dienstkonto-anmeldung.sql.

   • Create now: after the installation, the program creates the login and users itself, with your Windows account. Your account needs the permission to do so in SQL Server, for example as a member of sysadmin. The script is written to the data folder as well.

     Enter the SQL Server (as in a connection string, for example .\SQLEXPRESS), the databases (comma-separated), and the roles of a new user: Read and write (db_datareader, db_datawriter, default), Read only, or No role. If SQL Server runs on another machine, the login is for the computer account (DOMAIN\MACHINE$). Anything that already exists stays unchanged, including its roles, so a second run changes nothing. If your permissions fall short, the Done page shows SQL Server's error number, and the installation stays in place.

     

7. Folders: program and data folder, separate.
8. Certificate:
   • Existing certificate from the computer's store (list with issuer and expiration);
   • Let's Encrypt: public name (such as data.example.com) and validation through DNS (Cloudflare, Azure DNS, Amazon Route 53, Hetzner) or through HTTP (port 80 reachable from the internet). The order is placed after installation in a separate window;

   • Self-signed, only for trials in the corporate network.

     

9. Post-quantum protection: off (default) or hybrid key exchange X25519MLKEM768. The setting applies to the whole computer. It requires a Windows version that offers this key exchange; if Windows doesn't support it, setup fails and the installation is rolled back.

10. Access: Corporate network only (default; the firewall rule admits only the corporate networks entered—with no networks entered, only the server's local subnet; with this choice the service itself doesn't restrict anything by origin) or Also from the internet with the corporate networks and the choice of whether administration from outside is blocked or requires a second factor. The page shows the sign-in rules created for this. These rules apply only to a new administration store. When you change an existing installation, the rules in the store stay as they are, and the installer notes this in its log. Adjust them in the administration app.

    

11. Summary: check your choices. Under Command line for software distribution, the same installation appears as an msiexec call. Select Install, and confirm the User Account Control prompt.

    

12. Done: the program queries the service (/health/live) and, step by step, shows what was created in SQL Server or already existed (with Create now), or where the script is. Leave Create the first administrator now selected: after Close, a console window with init-admin opens; continue with Create the first administrator. With Let's Encrypt, win-acme also opens for the order.

Result: the service runs and responds. Administration stays locked until the first administrator has been created.

In the Services console (services.msc), it appears as WKL Database Gateway with the status Running, the startup type Automatic, and the service account you chose:

The installed service in the Services console (German-language Windows).

The virtual service account in the service properties. It has no password.

At a command prompt (cmd) as an administrator:

msiexec /i Wkl.Data.Gateway-<version>.msi /qn GW_HTTPS_PORT=8433 GW_CERTIFICATE=data.example.com ^
  GW_ACCESS=internal GW_NETWORKS="10.0.0.0/8,192.168.0.0/16" /l*v %TEMP%\gw-install.log

Return value 0 is success, 3010 success with a restart required; any other number is an error whose reason is in the log (search for Return value 3 or Rückgabewert 3).

With a user interface (msiexec /i without /qn), the package shows its dialogs in German; TRANSFORMS=:1033 shows them in English, TRANSFORMS=:1060 in Slovenian.

The installation program accepts the same values with /quiet. Without a user interface, init-admin doesn't start; the event log (source Wkl.Data.Gateway) names the next step. All properties are in the technical reference.

Start the installation program again (or Apps & features > WKL Database Gateway > Modify):

A newer version updates the installed one: it takes over the settings and first backs up the administration store to %ProgramData%\Wkl.Data.Gateway\sicherungen. Without a successful backup, there's no update.

Up to the version of November 3, 2026, the program file was named Wkl.Data.Gateway.exe. The update removes it, puts dbgwsvc.exe in its place, and enters the new path in the service; the service name, service account, data folder, and event source stay Wkl.Data.Gateway. Change your own scripts and scheduled tasks that call the old file to dbgwsvc.exe.

• Login for the service account in SQL Server. A data source with Windows authentication (Integrated Security) signs in under the service account. Until SQL Server has a login for it and a user in the database, the connection test fails with failure = Login (18456) or Database (4060). Which name is meant—on the same machine the service account, from another machine the computer account—is returned by `GET /admin/v1/service-account`. The database administration creates both, for example for reading and writing:

  CREATE LOGIN [NT SERVICE\Wkl.Data.Gateway] FROM WINDOWS;   -- another machine: [FIRMA\SRV-DATEN$]
  USE [Fachdaten];
  CREATE USER [NT SERVICE\Wkl.Data.Gateway] FOR LOGIN [NT SERVICE\Wkl.Data.Gateway];
  ALTER ROLE db_datareader ADD MEMBER [NT SERVICE\Wkl.Data.Gateway];
  ALTER ROLE db_datawriter ADD MEMBER [NT SERVICE\Wkl.Data.Gateway];

  To read tables and views, db_datareader is enough; it also covers SELECT on table-valued functions. Procedures and scalar functions need EXECUTE, even when the data source is only read, for example GRANT EXECUTE ON SCHEMA::[dbo] TO [NT SERVICE\Wkl.Data.Gateway]; per schema. Without it, SQL Server hides them from the account: the service doesn't know them and refuses a call the same way as an object that isn't released („… ist unbekannt oder für Lesen nicht freigegeben.“). The set DataSourceObjects of the administration API shows which objects the service has in its catalog. With Persons = Impersonate, the account also needs IMPERSONATE; see identity pass-through.

  The command service-login in the program folder produces the same as a script that leaves existing objects unchanged, also after the installation, for example for another database:

  "%ProgramFiles%\Wkl\Data Gateway\dbgwsvc.exe" service-login --server .\SQLEXPRESS --database Fachdaten --script dienstkonto-anmeldung.sql

  With --apply instead of --script, it creates the login and users right away, with your Windows account. For all options, see Commands.

• Back up the master key. Without the file geheim\hauptschluessel.key in the data folder, the store is unreadable. Back it up outside the server after installation, see Back up the administration store.
• Behind IIS. The program installs neither IIS nor its modules URL Rewrite and Application Request Routing. It writes the template iis\web.config to the program folder (forwarding to the service, redirection from HTTP to HTTPS). In IIS, create a website with a binding on 443 and your certificate whose content is this template, and allow the server variable HTTP_X_FORWARDED_PROTO. Behind this template, users sign in with a key or a SQL Server login, not with their Windows account: IIS forwards requests from different users over shared connections, and a Windows sign-in applies to the connection. See Run the service behind IIS or a proxy.
• Let's Encrypt needs a public name; for a service only in the corporate network, validation through DNS is suitable. win-acme itself asks for agreement to the terms, an email address, and access to the DNS API, stores this access protected, and renews the certificate in time through a scheduled task of its own. The service picks up a new certificate without a restart. If the machine already renews certificates with another copy of win-acme (for example for websites in IIS), that copy also orders and renews the data service's certificate, and its task stays as it is. It needs version 2.2.9 or later; if it's older, the order stops, names the version found, and changes nothing. The order window shows which win-acme is used.
• What remains after removal: certificates in the store, the Windows post-quantum setting, and the settings of win-acme (%ProgramData%\win-acme). The program removes win-acme's scheduled task only if it starts the bundled win-acme; the task of another copy stays.
• Log. The last page links to the installation log; every run writes it to %TEMP%\Wkl_Datendienst_*.log. It contains neither the master key nor a personal key.

• Create the first administrator
• „Connect a data source“ (documentation of the administration app)
• Back up, restore, and move the administration store
• Reference: Installation package (Windows), Certificate without a restart