Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a developer needing some guidance on setting up proper accounts/permissions for the following so bear with me please.

I am creating a private MS Queue and installing a windows service on a Win 2K3 Server. In order for the windows service to read/from, write/to the queue what type of group account should the windows service be running under - (Local Service maybe)? So for example if I install the windows service with a local service account I would need to go to private queue and add the Local Service group to queue permissions setting it up for read/write access, correct? A buddy of mine mentioned creating a different group and adding accounts to the group then assign group to Queue. How would this be different then using Local Service Group, if my assumption below is correct?

(Scenario 1) I'm thinking I would need to create a user account and make the account a member of Local Service. If that's correct in my assumption then I would go to Queue and add Local Service group to queues permissions. Is that correct?

(Scenario 2) If I went with the idea of going with a new group can I use that group to run the windows service, If so how do I set that up with proper permissions to run windows service?

Creating a group seems to me to be a good idea since I will deploy this solution to two w2k3 boxes.

share|improve this question

If the queue will be created manually, before running the service, then yes - you just need an account (group or user, your choice) with R/W access to the queue, on each machine.

You do not need remote send permissions on the incoming queue - that is already taken care of (Everyone may send messages to a queue, if it was created with the default values.)

All that is required is R/W/mgmt permissions for the local service account on the local private queue, for each machine - they don't have to be the same account either.

NOTE that a private queue is NOT shared across machines - no queue is, if you're not publishing them in AD.

So machine 1's /private/QueueX$ queue is unrelated to machine 2's /private/QueueX$ queue.

We use MSMQ extensively but our application create queues on demand; while this is more flexible overall, it requires more permissions for this service account: full control on the MSMQ service.

share|improve this answer
Hi Adaptr - Thanks for responding. So if I create a user account and assign them to Local Service group. I could then go to manually created queue permissions and just add Local Service giving this group R/W access to queue, correct? or should it be the other way around just add new user account to queue permissions. So if I added a different application on to same box that sends data to queue I could use same user account? – DotNetDude Feb 1 '12 at 16:13
In a different scenario - If I had an application on a different box try to send data to this private queue what user account would have to be listed in domain and then I would think need to be added to Local Service on private queue box, correct? – DotNetDude Feb 1 '12 at 16:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.