Reading and writing data and log files authorized by an alternative local security group

This task shows how to use the -a flag on the crtmqm command. The flag provides the queue manager with an alternative local security group to give it access to its log and data files.

1. Set up an alternative security group.

   The alternative security group is typically a domain group. In the example, you create a queue manager that uses a local alternate security group. With a local alternate security group, you can do the task with an IBM MQ installation that is not part of a domain.

   1. Run the lusrmgr.msc command to open the Local Users and Groups window.
   2. Right-click Groups > New Group...
   3. In the Group name field, type altmqm and click Create > Close.
   4. Identify the user ID that runs the IBM MQ service.
      1. Click Start > Run..., type services.msc and click OK.
      2. Click the IBM MQ service in the list of services, and click the Log On tab.
      3. Remember the user ID and close the Services Explorer.
   5. Add the user ID that runs the IBM MQ service to the altmqm group. Also add the user ID that you log on with to create a queue manager, and run it interactively.
      • Windows checks the authority of the queue manager to access the data and logs directories by checking the authority of the user ID that is running queue manager processes. The user ID must be a member, directly or indirectly through a global group, of the altmqm group that authorized the directories.
      • If you installed IBM MQ as part of a domain, and are going to do the tasks in Create a multi-instance queue manager on domain workstations or servers, the domain user IDs created in Creating an Active Directory and DNS domain for IBM MQ are wmquser1 and wmquser2 .
      • If you did not install the queue manager as part of a domain, the default local user ID that runs the IBM MQ service is MUSR_MQADMIN. If you intend to do the tasks without Administrator authority, create a user that is a member of the local mqm group.
      • Follow these steps to add wmquser1 and wmquser2 to altmqm . If your configuration is different, substitute your names for the user IDs and group.

      1. In the list of groups right-click altmqm > Properties > Add....
      2. In the Select Users, Computers, or Groups window type wmquser1 ; wmquser2 and click Check Names.
      3. Type the name and password of a domain administrator in the Windows Security window, then click OK > OK > Apply > OK.
2. Open a command prompt.
3. Restart the IBM MQ service.

   You must restart the service so that the user ID it runs under acquires the additional security credentials you configured for it.

   Type the commands:

   
   endmqsvc
   strmqsvc
   

   The system responses:

   
   5724-H72 (C) Copyright IBM Corp. 1994, 2024. ALL RIGHTS RESERVED.
   The MQ service for installation 'Installation1' ended successfully.
   
   And:
   
   5724-H72 (C) Copyright IBM Corp. 1994, 2024. ALL RIGHTS RESERVED.
   The MQ service for installation 'Installation1' started successfully.
   

4. Type the command:

   
   md c:\wmq\data, c:\wmq\logs
   

5. Set the permissions on the directories to allow the local user user read and write access.

   
   cacls c:\wmq/T /E /G altmqm:F
   

   The system response:

   
   processed dir: c:\wmq
   processed dir: c:\wmq\data
   processed dir: c:\wmq\logs
   
6. Optional: Switch to a user ID that is a member of the local mqm group.
   • You can continue as Administrator, but for a realistic production configuration, continue with a user ID with more restricted rights. The user ID must at least be a member of the local mqm group.
   • If the IBM MQ installation is configured as part of a domain, make the user ID a member of the Domain mqm group. The Prepare IBM MQ wizard makes the Domain mqm global group a member of the local mqm group, so you do not have to make the user ID directly a member of the local mqm group.
7. Create the queue manager.

   
   crtmqm -a altmqm -sax -u SYSTEM.DEAD.LETTER.QUEUE -md c:\wmq\data -ld c:\wmq\logs QMGR
   

   The system response:

   
   IBM MQ queue manager created.
   Directory 'c:\wmq1\data\QMGR' created.
   The queue manager is associated with installation '1'
   Creating or replacing default objects for queue manager 'QMGR'
   Default objects statistics : 74 created. 0 replaced.
   Completing setup.
   Setup completed.
   
8. Check that the directories created by the queue manager are in the c:\wmq directory.

   
   dir c:\wmq/D /B /S
   

9. Check that the files have read and write, or full control permission for the local mqm group.

   
   cacls c:\wmq\*.*