Correcting security permission issues after moving Microsoft Message Queuing (MSMQ) off the system drive
book
Article ID: 100031234
calendar_today
Updated On:
Cause
Performance or disk space issues could required relocating MSMQ directories off the system drive.
Deployment Scanner Warning:
It is recommended that the MSMQ storage directories are located on a non system drive.
Symptoms
The MSMQ root and sub-directories could inherit security permissions at the destination volume resulting in one of the following symptoms:
- A1 and A2 or R1 and R2 (if Journal Archiving is enabled, J1 and J2) private queues may disappear.
- Enterprise Vault (EV) server could be reported as Not Available when attempting a manual archive (A1 and A2 missing).
- Enterprise Vault Client trace showing 0x8007005 (Access Denied) when trying to archive or restore a vaulted item.
- Where MSMQ private queues are available, archiving may seem to take too long to complete processing items regardless of how much the administrator tries to optimize Enterprise Vault Application settings.
- Enterprise Vault Event logs may not flag any obvious error messages on Message Queuing but some warning events could contain a description string suggesting not enough storage available to complete this operation.
Resolution
Pre Windows 2008 Procedure:
- Log on to the EV server and stop the Enterprise Vault Admin Service
- Accept the warning that other dependent services will also stop.
- Locate the desktop icon My Computer, right click and select Manage.
- Expand Services and Applications > Message Queuing.
- Right click Message Queuing > select All Tasks > Take Message Queuing Offline...
- Left click Private Queues in the left pane.
- The column labeled Number of Messages in the right pane should list zero (0) entries otherwise continue to step 11.
- In the right pane, right click any EV queues containing messages and click New Window from here.
- In the left pane, click Queue messages to preview the list in the right pane
- Note: This action should only be carried out with express notification from Veritas support personnel.
Right click Queue messages select All Tasks > Purge and click Yes to accept the admin prompt.
- Exit the current queue window via the lower X, top right.
- Repeat steps 8 - 10 to clear every EV queue and associated admin queue listing a number of messages greater than 0.
- Repeat step 6 above to verify that all EV queues have zero entries.
- Make sure Message Queuing remain in the Offline state (step 5).
- Set security permissions on the new ?:\MSMQ\Storage location exactly as follows:
- Share = None.
- Security = Right click the new MSMQ root directory and click Properties > Security tab.
- Click Advanced > clear the tick box at Allow inheritable permissions.
- Click Copy.
- Skip the local machine Administrators group and highlight each entry one at a time under Group or user names: then click Remove.
- In Advanced Security Settings for MSMQ verify that the local machine Administrators group now has Special Full Control Permissions <not inherited>.
Figure 1

- Set Apply onto to This Folder and files.
Figure 2

- Repeat steps a - f on the \Storage subfolder.
Windows Server 2008 / Windows Server 2012 Procedure
Assign MSMQ group permissions to the MSMQ storage location using the command line, this is not possible using the GUI.
icacls "MSMQStoragelocationpath" /grant "NT SERVICE\MSMQ":(OI)(F)
To read a bit more about icacls and related switches please see the following technet article:
Icalcs
https://technet.microsoft.com/en-us/library/cc753525.aspx
Then, follow these steps:
- Take Message queuing offline within Server Manager.
- Take Message Queuing Service offline.
- Change the storage file path to desired location.
- Bring Message Queuing service online.
- Bring Message Queuing online within Server Manager.
- Validate Drive:\MSMQ\Storage location for newly created files (LQS folder and approx 5 other LG* files)
Caveat:
Microsoft Message Queuing (MSMQ) is a Microsoft component and as such any errors that can't be addresses in this document should be put to Microsoft Support.
Issue/Introduction
Correcting security permission issues after moving Microsoft Message Queuing (MSMQ) off the system drive
Was this article helpful?
thumb_up
Yes
thumb_down
No