- 3 minutes to read

Release Notes

Troubleshooting

On this page you will find answers to some of the most frequently asked questions regarding monitoring of Message Queuing technologies.

Access denied using the MSMQ MMC

🛠️ Fixing "Access Denied" in MSMQ MMC

If you're getting "Access Denied" when trying to modify MSMQ queue permissions (e.g., in MMC or via Nodinite monitoring), follow the revised and complete guide below to fully regain control of your queues.

✅ Why this happens

This issue usually occurs because:

  • The "Everyone" group or your admin user account has been removed from the queue's Security descriptor (ACL).
  • MSMQ's internal queue definitions (stored as .lqs files) have incomplete or corrupted permissions.
  • You're using an account that lacks NT AUTHORITY\SYSTEM or full control privileges on the queue.

✅ Updated Step-by-Step Fix

Important

You must perform the following steps using an elevated administrator account with ownership rights to the MSMQ folder and system permissions.

  1. Stop the MSMQ Service
  • From an elevated Command Prompt or PowerShell:
net stop msmq
  1. Take Ownership of LQS Files (if needed)

-Sometimes the files are protected even from administrators.

takeown /f "C:\WINDOWS\system32\msmq\storage\lqs\*" /a
icacls "C:\WINDOWS\system32\msmq\storage\lqs\*" /grant administrators:F

This ensures you can read/write the LQS files.

  1. Identify the Problem Queue
  • Navigate to:
C:\WINDOWS\system32\msmq\storage\lqs

Use a text editor (like Notepad++ run as Administrator) to search inside the .lqs files for your queue name (e.g., logapiserviceoneway.svc).

Open the correct file once identified.

  1. Copy a Working Security Descriptor
  • If you have another private queue that works (you can access it in MMC):
    • Open its .lqs file.
    • Find the line beginning with Security=
    • Copy the entire line (watch out for word wrap)

Tip

If you don't have another queue, create a temporary private queue in MSMQ MMC, assign it default permissions, and copy the Security= line from there.

  1. Replace Security Descriptor in Problem Queue

In the .lqs file of the problem queue, replace the existing Security= line with the working one.

Save the file (ensure it’s saved as UTF-8 with no extra formatting).

  • Set Correct File Permissions on the Modified File

Sometimes even after modifying the file, MSMQ cannot read it due to incorrect file ACLs.

  • Run the following command:
icacls "C:\WINDOWS\system32\msmq\storage\lqs\YourQueueFile.lqs" /grant "NT AUTHORITY\SYSTEM":F
  • Replace YourQueueFile.lqs with the actual file name.
  1. Restart MSMQ

You need to restart the MSMQ service to apply changes:

net start msmq
  1. Verify Access in MMC
  • Open MMC > Message Queuing > Private Queues
  • Right-click the queue → Properties → Security tab
  • Confirm you can now view and modify permissions

🔒 Optional: Restore Secure Default Permissions

After access is restored, consider removing excess permissions and applying a known good security policy for your environment (consult your security team).

📞 Still having issues?

If the issue persists, your system may be affected by:

  • Group Policy overwrites
  • NTFS-level file locks
  • MSMQ corruption

If you still cannot resolve the issue, please contact Support for further assistance.

How do I enable monitoring of Azure Service Bus

To Monitor the Azure Service Bus; Check the Enable monitoring for Service Bus checkbox (default is checked). Additional configuration is required; Review the 'User access to Azure Service Bus monitoring' user guide for specifics.

The screenshot below is from the remote configuration form available from the Monitoring Agents administration page.
Enable Monitoring
Example with monitoring for Azure Service Bus resources enabled.