Install the partner application

About 65 seconds, narrated, with captions. Sample company, made-up data.

The partner application runs as a Windows service. It starts with Windows, with no window to keep open, and you open it from the Start menu. Setup asks who can reach it:

This computer only (the default). Open http://localhost:5190/ on this computer. Nothing listens on the network. Use localhost rather than 127.0.0.1: Edge and Chrome sign you in with Windows by themselves only there.
Computers on my network. Consultants open it from their own computers, such as https://partnerserver:5190/, and sign in with their Windows account. http://localhost:5190/ still works on the computer itself.

Either way, people see only the customers an admin gives them (see Security). You can change who can reach it later in setup or Settings.

What you need

Windows 10 or 11, or Windows Server 2016 or later, and an administrator's rights to install.
A SQL Server for the workspace, where every customer's data and every decision is kept. SQL Server Express on the same computer is enough.
Your partner license key, from your partner welcome email. It starts with LDP-. A Ledger Doctor customer license key (it starts with LD-) isn't accepted.
For computers on your network: the computer joined to your Windows domain, and a name people can reach it by (its computer name is enough).
The computer has to reach api.myledgerdoctor.com on port 443 (HTTPS).

Install

Unzip the download and double-click LedgerDoctorPartner.exe. Choose Yes when Windows asks to allow changes. Setup opens in your browser.
SQL Server workspace. Name the SQL Server (.\SQLEXPRESS for SQL Server Express on this computer) and choose how setup signs in: your Windows account, or a SQL login. Select Test the connection. Setup checks it may create the workspace database, or that it can open the one already there.
Partner license key. Paste it and select Check it. Setup shows your partner code and name. If myledgerdoctor.com can't be reached, a key that starts with LDP- is saved without the check.
Who can reach it. This computer only, or computers on your network. For the network, choose the address people use (below), any other names, and HTTPS. Check the names checks each leads to this computer.
Port. 5190 unless another program uses it.
Optional: your Sage Intacct client ID and secret (the Implementation default; add the Production one in Settings), and your defaults (the opening entry's journal, the statistical journal, and a GP account custom field). You can set these later in Settings.
Select Install. Setup creates the workspace database, copies the program to Program Files, puts its settings, keys and logs in C:\ProgramData\Ledger Doctor Partner, installs the service and adds Ledger Doctor Partner to the Start menu. For computers on your network, it opens the port in Windows Firewall for the domain network only and sets up HTTPS. It makes you, the person running setup, the first admin; on an update from 0.1 you're also an Approver for every customer. It then starts the service and checks it answers.

How it runs

The service runs as its own Windows account, NT SERVICE\LedgerDoctorPartner. With Windows sign-in, setup gives that account access to the workspace database. On another SQL Server, it's this computer's account.
People sign in with their Windows account in the browser, and each decision keeps their name.
A SQL login's password is kept only encrypted for this computer. The settings file never holds it readably.
The license key, your Sage Intacct secret and your customers' data are encrypted with keys that belong to this computer, kept in the ProgramData folder. That folder is open only to administrators, Windows itself and the service.
Updates still install themselves. Install and restart puts the new version in place, and Windows starts the service again a few seconds later.
The log is in C:\ProgramData\Ledger Doctor Partner\Logs, and in the Windows Application event log.

Computers on my network: the address

The server's computer name, such as PARTNERSERVER. People open https://partnerserver:5190/, and on computers joined to your Windows domain, Edge and Chrome sign them in with Windows by themselves. No IT setup is needed. On a computer that isn't on the domain, the browser asks for the Windows sign-in instead.
A full name, such as partnerserver.corp.example.com. Edge and Chrome sign in by themselves only once IT adds it by group policy: to the Local intranet zone (Site to Zone Assignment List, *.corp.example.com = 1), or to the browsers' allowlist (AuthServerAllowlist). Until then each person is asked for their Windows user name and password. Setup and Settings say exactly what to add.
Other names, such as an alias in DNS. Each has to lead to this server, and the certificate covers them all.

Changing the address later, from the computer name to a full name for example, is a change in Settings (Server and HTTPS) or setup, not a reinstall.

HTTPS

For computers on your network, HTTPS works as it does in Ledger Doctor. Choose one:

Make one for this server. The application makes its own certificate authority and a certificate for every name people use, and renews the certificate by itself 30 days before it expires. Each computer trusts the authority once: download ledger-doctor-partner-ca.cer from Settings, or from http://partnerserver:5190/ledger-doctor-partner-ca.cer, and add it to Trusted Root Certification Authorities, or have IT send it out with group policy.
One from the server's certificate store (Local Computer, Personal), such as one your company's certificate authority issued. It can switch by itself to a renewed certificate with the same name.
A .pfx file. Its password is used once to open it and is never saved.

The certificate has to cover the address people use. Admins can replace it later in Settings, Server and HTTPS: the application checks it answers with the new certificate, and puts the old one back if it doesn't. Every page shows a notice 30 days before a certificate expires (unless it renews itself). The old http:// address sends people to https://. For IT, on the server as an administrator: LedgerDoctorPartner.exe https status, https make [other names], https use THUMBPRINT, https pfx FILE (the password from LD_PFX_PASSWORD, or asked for) and https off.

Security

Admins give roles in Settings, Security, to Windows accounts or AD groups:

Admin manages Security and the settings: the license key, server and HTTPS, the Sage Intacct client, your defaults and updates. Admin alone doesn't open a customer's data. There's always at least one admin; setup makes the person running it one. On a team server, setup also offers to make that person an Approver for every customer (ticked unless you untick it), and logs it.
For one customer, or every customer: Approver approves and overrides decisions, freezes plan versions, runs the Sage Intacct steps, accepts or ends the connection, and exports the frozen version's files. Processor works the mapping and the Sage Intacct checklist, asks for fresh data and exports drafts; their account decisions go to an approver as proposals. Read-only sees the customer's pages.

A consultant sees a customer only once given a role for it; each GP company a customer connects is listed, and the Security page can give a role for all of a customer's companies at once. Security is always on: a solo consultant is simply the only Admin. Every security change goes in the security log, and every decision keeps who made it.

Email

An admin sets up email in Settings, Email: Microsoft 365 (an app registration with the Mail.Send application permission; Microsoft is turning off passwords for SMTP) or a mail server (SMTP, port 587 with TLS), and the address it's sent from. Send a test email checks it. The password or client secret is kept encrypted and never shown again.

Each email goes to the person's address in Active Directory, or the one they give in My preferences, where they can turn each kind off:

The HTTPS certificate expires within 30 days (Admins).
A customer asks to connect (Admins, and Approvers for that customer), with a link to accept or decline.
Data you asked a customer for has arrived (whoever asked), with what changed in its counts.
A new version was installed (Admins).

Moving a copy that ran in a window

Before 0.1.13, the application ran in a window as one Windows user, with that user's keys. To move it to the service:

Close its window.
Signed in as the same Windows user, run LedgerDoctorPartner.exe setup from the new download, and point it to the same SQL Server and workspace database. Setup finds the workspace and keeps it.
The step Keys and customer data from before moves everything the old keys protected to the service's keys: the application's private keys, so your customers stay connected; your Sage Intacct secret; and every stored package and plan version.

If setup can't read something, it says what. Usually that means another Windows user ran the application before. Run setup again as that user, or use Ask for fresh data on the Customers page for a new package.

Change it later or remove it

Run setup again: LedgerDoctorPartner.exe setup in C:\Program Files\Ledger Doctor Partner, as an administrator. It keeps your settings, lets you change the SQL Server, the port, who can reach it, the address and HTTPS, and has Remove. Admins can also change who can reach it in Settings, Server and HTTPS; the application restarts in a few seconds. Only setup can change Windows Firewall, so after opening it to your network in Settings, run setup's Update once. Removing it keeps the workspace database, with every decision and its history, and keeps the settings and keys unless you tick the box to remove them too.

For IT: LedgerDoctorPartner.exe setup --answers answers.json installs without the browser (a SQL login's password from the LD_PARTNER_SQL_PASSWORD environment variable; for computers on your network, "mode": "server", "address", "extraNames" and "https": made, store:THUMBPRINT, pfx with "pfxFile" and LD_PFX_PASSWORD, or off), and LedgerDoctorPartner.exe uninstall removes it.