- 2 minutes to read

MSMQ Queue Access Denied

If you get an "access denied" message when you try to change the permissions of an MSMQ private queue, this guide restores the queue's security descriptor so Nodinite can use the queue again.

When This Happens

In Nodinite v7, MSMQ queues are read by the Pickup Service (the MSMQ configuration picks up Log Events and sends them to the Log API) and monitored by the Message Queueing Monitoring Agent (Monitoring MSMQ). The WCF-over-MSMQ endpoint of earlier Log API versions doesn't exist in v7; see Log using WCF.

A queue becomes locked when a service or an administrator removes the Everyone group from the permissions of a private queue. You then can't change its permissions: when you click Apply or OK, you get access denied. The account that runs the Pickup Service or the agent then can't read the queue either.

Restore the Queue Permissions

The permissions of each private queue live in its LQS file. Copy the security line from a queue that works:

  1. Stop the Message Queuing service.
  2. Open the folder C:\WINDOWS\system32\msmq\storage\lqs.
  3. Find the file that describes your problem queue.
  4. In Notepad, open the LQS file of another private queue that has correct permissions. If you have no other private queue, create one.
  5. Find the line that begins with Security=.
  6. Copy the entire Security= line; it is usually very long, so watch out for word wrap.
  7. Open the LQS file of your problem queue in your text editor.
  8. Overwrite its Security= line with the one you copied.
  9. Save the modified LQS file.
  10. Start the Message Queuing service.

The problem queue now has the same permissions as the working queue. Grant the service account of the Pickup Service or the agent the rights it needs on the queue; see Logon as a Service right for the service accounts Nodinite uses.

Next Steps