Routing Support in MSMQ requires Enterprise Administrator privileges
One down-side of enabling Routing Support for MSMQ is that you need to be an Enterprise Administrator to install it, as can be seen from this Technet article:
| Message Queuing computer | Permission level required |
|---|---|
Message Queuing server on a domain controller |
domain administrative permissions (or member of the Domain Admins group) |
Message Queuing server on a nondomain controller with Routing Support |
enterprise administrative permissions (or member of the Enterprise Admins group). |
Message Queuing server on a nondomain controller without Routing Support |
local administrative permissions (or member of the local Administrators group) |
Independent client |
local administrative permissions (or member of the local Administrators group) |
Dependent client |
local administrative permissions (or member of the local Administrators group) |
It is common not to see any effects from this restriction as installation is usually performed by the all powerful domain Administrator account.
One place you may see issues, though, is installing MSMQ on a cluster. In Cluster Administrator the newly created MSMQ resource will fail to come on line (after several attempts).
Looking in the event log, there will be an "Access Denied (0xC00E0025)" event for every attempt to bring the MSMQ Cluster Resource on-line.
This is because the MSMQ resources are created by the Cluster Service account and not the logged in user account. There error is confusing as you will see what looks like a good configuration in Active Directory: Users and Computers as the MSMQ object has been successfully created under the computer object for the resources network name and public queues can be created.
The permissions issue is actually with the Active Directory objects to do with routing and these need Enterprise Admin membership (or equivalent) to update.
The options are therefore:
- If you need routing support, add the cluster service account to the Enterprise Admins group. This may, though, conflict with some customers' security policies.
- If you do not need routing support, then remove it. No need to change account membership.
Note - you cannot simply untick Routing Support from the local node installations. As indicated by the error message below, removing Routing Support requires a reinstallation of Message Queuing.
