Access to Message Queuing system is denied

Question

I am trying to access queue message from my host, while trying to get message i am getting "Access to Message Queuing system is denied." message. Don't know how to solve this issue. I am using Windows 7 as client system and server is Windows 2008 R2 Server

Irreparable

Answer 1

I ran into the same issue trying to write to the MSMQ through ASP.NET (Windows 7). I added "Receive Message" "Peek Message" and "Send Message" permissions and it works correctly now. If you're running this through ASP.NET, then you're probably under the IIS_IUSRS account.

Minstrelsy

How do you add those permissions? – Chrissa

Under computer management (right click "Computer" from the start menu and choose "Manage"), go to the "Message Queuing" section and right-click on the queue name you want and choose "Properties" --> click the "Security" tab and you can manage the permissions there. – Minstrelsy

I have those permissions setup and it still is throwing this error – Thecla

@Thecla If security isn't a big issue for you, You can follow saille's answer in which he unchecked: "Disable un-authenticated RPC calls" – Giant

Answer 2

In my case, the MSMQ queues were owned by my own Windows user-account (local admin), because they had been created from running a console app from Visual Studio in administrator mode.

My web-app runs as NETWORK SERVICE, which spawned the

Access to Message Queuing system is denied

error.

I fixed this by giving NETWORK SERVICE full control:

Computer Management > Services and Applications > Message Queuing > Private Qeues > Right click queue > Properties > Security

Restart MSMQ service and IIS:

NET STOP MSMQ
NET START MSMQ
IISRESET

Feebleminded

Answer 3

Server2008:

1. Control Panel->Administration Tools->Computer Management.

2. In Computer Management->Services and Applications->Message Queuing->Private Queues.

3. Right Click [UrQueueName] -> Properties -> Security
   • Set Everyone to Full Control
   • Set ANONYMOUS LOGON to Full Control.
4. In Computer Management -> Services
   • Restart Message Queuing service.

In Windows 7(Client): Create Rc Message Queue with FormatName:DIRECT=OS:MachineName\private$\UrQueueName

Example:

rcmq = new System.Messaging.MessageQueue(string.Format("FormatName:DIRECT=OS:{0}\\private$\\{1}", rcMachineName,rcQueueName)); 

Harville

Answer 4

Thanks to this post, I've been able to remove the "Access Denied" problem: https://codifying.wordpress.com/2012/04/16/msmq-solving-access-denied-errors-for-private-queues/

The original problem

...is frustrating, the queue is listed in the Server Management under Private Queues, but I was no possibility to :

• Delete => Permission denied
• Edit security permission => Permission denied
• View the remaining message in the queue => Permission denied

The solution

1. Create a queue manually (used later), let's call it FA1
2. Close Services: Message Queuing (+ Listener Adapter for Net.Msmq)
3. Then go to %windir%\System32\msmq\storage\lqs
4. Find the latest file for FA1 (check if it's the right file, every file in here can be opened with notepad) and then copy the value of the attribute Security
5. Find the file associated with the issue queue, paste it the value copied in the previous step
6. Delete the file associated with FA1
7. Open the two previously closed services
8. Go to Server Manager

The error message should no longer appear

But... you might get another problem with your software while trying to read/connect to that queue, it will complain that it has not enough privileges, so the last step is to go to the advanced properties of that queue and set the full control access to everyone (well, maybe you will specify a specific user, but that's what I did to ensure that I don't get blocked on my own dev server).

Mayfly

This is the correct answer. The only addition is you will want a copy of the FA1 file to put back in the folder so you can later delete the temporary FA1 queue as a final step. – Necrotomy

Answer 5

If you are trying to read a message from a remote queue then permissions is the main culprit, as kprobst mentioned.

You can also get other causes:

Failing to read from remote MSMQ queues

Poche

Link is bad now – Overpower

Fixed. My blog has been archived to learn.microsoft.com/en-us/archive/blogs/johnbreakwell – Poche

Answer 6

There are many reasons for this error. One, it could be security. You need to make sure that the account under which your application is running has read/write access to the queue (or as high a permission level as you need).

Second, make sure that if the queue is transactional, you're using the correct transaction mode for it. Or alternatively, if the queue is not transactional, that you're not attempting to pass a transaction mode to it when you read or write.

Accumulation

Transactional/Non-transactional will not create Access Denied errors. You should get transaction-specific errors - 0xC00E0050 (MQ_ERROR_TRANSACTION_USAGE). – Poche

@JohnBreakwell thanks for the clarification, I did a bit of Googling and that came up. It would have been weird to me that this was the case, but I thought I'd mention it anyway just in case. The main culprit is almost always permissions. – Accumulation

Answer 7

For us, it was because a test program created the queue...

Solution: delete the queue and let it be recreated by the right processes running under the right credentials.

Cautery

Thank you for the assist! Same thing happened to us. In our case our Website queued up an Email to send, so since the Queue didn't exist on the New Server we were Migrating to, it was Created Automatically but under that Website's Authorization, and nobody (not even us Admins) could View or Change that Queue. In the end, we had to destroy it and re-create the Queue Manually (while RDP'd into the Server). – Outride

Answer 8

This worked for us: Server manager -> Features -> Message Queuing -> Right Click -> Properties -> Server Security

Un-check: "Disable un-authenticated RPC calls"

Melloney

Answer 9

This could turn into a frustrating issue. In my scenario, the exception was thrown on BeginReceive(). I had an existing message queue which was created by a .Net 2.0 application and I was trying to use it in another application that was running on .Net 4.0. The solution was to delete the MSMQ (located at C:\Windows\System32\msmq\storage\lqs ), and recreate it with .Net 4.0.

Dean

That's interesting. I take it you don't have copies of the problem LQS files anymore? – Poche

@JohnBreakwell Not anymore, upgrading applications from .Net 2.0 to 4.0 was an interesting practice. We faced new issues we never knew before. – Dean

Answer 10

In our case, changing the Identity of Application Pool of the web service that invokes the Peek MSMQ helped with this issue which started happening after a server migration.

We had to change the App Pool Identity from "ApplicationPoolIdentity" to "NetworkService". It worked afterwards.

Midwest

Answer 11

Please log in to your sever manager and check in your message queue properties that have assigned "send message" , "peek message" and other required privileges to IIS User or everyone ..

Nestor