MSMQ–Security descriptor cannot be set on private queue error

If you get the “Security descriptor cannot be set” error on a private queue, then it may have to do with permissions.

Here is how I solved it:

First thing to try:

By changing the ownership of the queue:

Right click on the queue and bring up the properties dialog.

On the “Security” tab, click on “Advanced”

Go to the “Owners” tab, select your account and click “Ok”. This should set you up as the owner. Now try and change the settings. If this works, you are done. If not read on:

Manually update security (this is hacky and do so at your own risk):

Private queue information is stored on the server where MSMQ is running in the folder “C:\Windows\System32\msmq\storage\lqs”

You will have to open all the files to find the one that stores the information for your queue. The name of the queue is stored in Label field:

The next thing you will have to do is create a dummy queue with the security setup such that you can edit that queue. After creating that queue, open up the configuration file from the “lqs” folder for that new queue and look for the “security” field. Copy that value from the newly created queue to the old queue which you could not edit. Save that file and restart MSMQ service.

You should be good to go!

Notes:

MSDN: Interpretting the file names in the storage directory of MSMQ