Message Queuing and Active Directory Domain Services

Applies To: Windows Server 2008

In a domain environment, one or more Message Queuing objects are created in Active Directory Domain Services during setup for all the types of Message Queuing computers except dependent clients. These objects store various information associated with Message Queuing. The access of users to Message Queuing objects is controlled by assigning security descriptors to the objects. A security descriptor lists the users and groups that are granted or denied access to an object and the specific permissions assigned to those users and groups. For more information about the control of access to Message Queuing objects, see Access Control for Message Queuing.

Note that if you install Message Queuing on a computer that is in a domain environment, and later re-image the computer, the new installation of Message Queuing on the computer will create a new Queue Manager globally unique identifier (GUID). This has the following effects:

1. The public queue data from the old installation of Message Queuing will no longer be usable.

2. The new installation of Message Queuing does not recognize the Message Queuing objects in Active Directory Domain Services that belong to the old installation. This prevents Message Queuing from working in Domain mode, which means that features that require Domain mode, such as access to public queues, authentication, encryption, and routing, will not be available. For more information, see Deploying in a Domain Environment.

To resolve the latter issue, the domain administrator must delete the Message Queuing objects in Active Directory Domain Services for the old installation of Message Queuing. Note that this will also delete all public queues for the computer that was re-imaged. For more information about deleting Message Queuing objects, see Remove Message Queuing Objects from Active Directory Domain Services.

Under certain conditions, the name of an object can be changed by the directory service. This can occur if multiple objects with the same name are created simultaneously on different domain controllers. For information about how Active Directory Domain Services handles object naming and conflicts, see the topic Object Names in the Windows Server® 2008 online Help file.

The following table lists those objects that are created by Message Queuing by default for each type of Message Queuing computer and that are displayed in the MMC snap-ins.

When you manually create an object in Active Directory Domain Services, you are prompted to specify the minimal information needed to establish the object in Active Directory Domain Services. Each object has many more properties (attributes) that can be set. After an object is created, the values of many of these additional attributes can be viewed and modified in the Properties dialog box.

In addition, some information for Message Queuing is also stored in Active Directory Domain Services in non-Message Queuing objects. Specifically, the User object contains information about user certificates, the applicable computer object (above the msmq object) contains certificate information, information related to foreign sites (for cross-platform messaging) is contained in the Sites object, and distribution lists are defined as distribution group objects.

For advanced information about object attributes, see the Active Directory Domain Services topic in the Microsoft Platform Software Development Kit (SDK). To access the Message Queuing SDK on the Web, refer to the MSDN Library Web site (https://go.microsoft.com/fwlink?linkid=79556).

In This Section

• Message Queuing Objects

• Message Queuing Object Locations

• Configuring DNS Settings for Message Queuing