Permissions to peek at a remote system queue?

Question

I'm working on a notification tool for our MSMQ instances at work. It will need to peek at every queue on a machine. However I'm having a hard time with the permissions related to the DeadLetter and XactDeadLetter system queues. Access is always denied.

I open up Computer Management, expand Services and Applications, right click Message Queuing and click properties. In the properties dialog, I go to the Security tab and add my domain service account user and indicate that I want to give the user Full Control. Upon clicking apply, I get this popup:

And when I click ok on that popup, I get:

I've looked into setting the security on queues manually, but it seems that system queues do not get files in C:\WINDOWS\system32\msmq\storage\lqs as described by this question.

If I try to take ownership over the Message Queuing, I get the same popups as above.

I'm told "Access to Message Queuing system is denied" in a MessageQueueException thrown at the MoveNext below:

MessageEnumerator enumer = messageQueue.GetMessageEnumerator2();
while (enumer.MoveNext()) {
    ...
}

What can be done to allow my service account to peek at the remote system queue?

Answer 1

I had the same issue recently, I couldn't assume ownership of the queues to set an account's permissions to peek. However, stopping the msmq service and using this advice solved my problem.

http://blog.aggregatedintelligence.com/2012/03/msmqsecurity-descriptor-cannot-be-set.html