Setting MSMQ permissions for a private queue created by a different user

Question

The person who was previously using my PC at work set up a private MSMQ that I need to access. They have since left the bank but the permissions remain and I can't access the queue or give myself edit permission to remove the restriction.

I am an admin on this machine now so I'm assuming there's some way for me to change things..Been searching high and low but most of what I find is related to doing things through scripts.

Any help appreciated,

thanks

Antilogy

Answer 1

Right click on Your Queue -> Properties -> Security -> Goto Advanced and modify permission for groups.

Acetylate

I couldn't Apply anything so I didn't think to go to Advanced settings! Turns out I just had to grab ownership of the queue, thanks! – Antilogy

Whenever I tried to apply any of the changes I'd made it would say I didn't have permission to make the changes, that's all. Changing the ownership over to me solved the issue. – Antilogy

Answer 2

And for a manual process if all else fails:

1. Stop the MSMQ Service (Services -> Message Queuing)
2. Open the C:\WINDOWS\system32\msmq\storage\lqs folder
3. Find the config file in this folder that describes a queue that has "good" security permissions. You will need to open each file in turn with a text editor to determine which queue it relates to.
4. Once you have the correct file open, locate the line in the file that begins Security=....
5. Copy the whole line to your clipboard (watch out for Word Wrap, this line will be quite long)
6. Find the config file in this folder that describes your problem queue
7. Open this file in a text editor.
8. Overwrite the Security=... line in this file with the contents of your clipboard
9. Save the modified file
10. Start the MSMQ service; new permissions will be picked up.

Cheers

John Breakwell

Waldowaldon

I saw this solution elsewhere, but my ...\lqs folder just has a bunch of files with long digit names and digit/letter extensions and I didn't want to start messing with things I didn't understand. Perhaps something on my PC is configured differently so I can't use this method? – Antilogy

The file names are the way they are for quick lookups by MSMQ. You just need to find the text file that contains the name of the queue you want. (See support.microsoft.com/kb/174307) – Waldowaldon

If you have not any queue that has "good" security permissions, then just create a new queue with required security permissions. And follow @JohnBreakwell Breakwell's steps with this new queue. Note: Do not forget delete that your new dummy queue when you finish. :) – Combative

Hello, John from 2011! I am from more than eight years into the future, and would just like you to know that at this point, you are stille helping people! Thank you so much! – Sherrell

I was I wasn't upvoting this answer 10 years after it was first provided. – Carpi

Answer 3

First, change the ownership of the queue to the Administrators group; then assign yourself the permissions you need.

Aurea

I don't get why this answer is getting downvoted. Based on the op's comments to the accepted answer, this is basically what he did to resolve his problem. – Hagar

@Hagar It is four years late, and does add nothing over the existing answers from four years ago. – Jere

I don't get how it's "late" considering the steps listed are still completely relevant. And it does add something over the answers, in that it specifies changing the ownership. Neither of the other answers mentioned that. The accepted answer won't work in most cases if you're not the owner (and in fact, as mentioned by the OP in a comment, he did have to change ownership first to get that answer to work), and this could be simpler than the manual method provided by John Breakwell, for people that are able to change ownership. – Hagar

My post was a 'last resort' method. – Waldowaldon

Answer 4

The easiest approach to allow modifying permissions from the user which didn't allow do this is to run PowerShell as Administrator and run the command:

Get-MsmqQueue -Name "MyQueue" -QueueType Private | 
  Set-MsmqQueueAcl -UserName "Everyone" -Allow FullControl

This will allow you to edit permissions in the Windows user interface.

Pissed

Answer 5

The previously mentioned solution to use Set-MsmqQueueAcl stopped to work after a recent Microsoft update.

An alternative code could be found here:

https://github.com/gavacho/System.Messaging.MessageQueue.SetOwner/blob/master/System.Messaging.MessageQueue.SetOwner.cs

This alternative way is not trying to write the Acl, but simply takes ownership. It is similar to using advanced security settings the change the owner. Acl can be changed when having ownership.

Studer