MQSeries.net :: View topic - MSUR_MQADMIN & WinXP & File System Permissions

RogerLacroix · Posted: Sun Nov 14, 2004 7:15 pm Post subject:

Hi Jason,

Since you are IBM's resident MQ and Windows expert, I have a question for you: Does IBM do MQ file system security differently on Windows XP than Windows 2000 (or maybe its more of just Windows file system permissions).

I have wasted a week with really weird problems testing a MQ security exit on Windows XP. The MQ security exit code works perfectly on Windows 2000 and Solaris 8. Actually, the same DLL was tested on Windows 2000 & Windows XP but only WinXP showed weird errors.

Errors included (WinXP only):
- FDCs being generated
- amqrmppa crashing
- Windows running crash reporter to send a report to Microsoft
- No log files being generated by the security exit

I started out with Windows XP Home Edition SP2 and WMQ v.5.3 CSD7 and gcc v3.2.3. I thought maybe the OS or the order of the install items was the problem.

So, I deleted the OS and installed Windows XP Pro and SP2 first before any else (I applied all XP patches including some related to loopback). Then I installed WMQ v5.3 and applied CSD8 and my old version of Visual Studio v6.

I rebuild the security exit (dll) with Visual Studio v6 (rather than gcc) and got the same error. I just couldn't believe it.

I have 2 sets of 'logging code' in the security exit and I was bewildered why both sets produced nothing, so I decided to go through the code with a fine toothcomb. Anyway, I discovered for one set, after it issued a fopen for c:\log.log that I never tested to make sure the fopen was successful. I mean, how could opening c:\log.log fail when I have a C drive!?!?!

Of course, when I fixed this silly little error, I longer generated FDCs or amqrmppa crashing or launching MS reporter. But no log files. Then I remembered about problems a triggered application had last year of not having access to printers on Windows 2000 Server, so it got me thinking.

When I tried a location of C:\Temp\log.log life was fine. Then I created an extra temp directory level and tried C:\Temp\Temp\log.log and it worked. But if I used C:\log.log it would fail. Once I figured this out, I was able to write the 'GetLastError' to a file that I could view. I was getting an ErrorCode of 5, which is 'ERROR_ACCESS_DENIED'.

After this ordeal, I really want to know why MSUR_MQADMIN cannot write to a file in the root directory of the C drive (on Windows XP)???? Is IBM setting file system permissions for MSUR_MQADMIN or is it WinXP doing something special for a system account??

Of course, now I get to move on to Windows 2003 Server and discover more odd ball behavior.

Regards,
Roger Lacroix
Capitalware Inc.
_________________
Capitalware: Transforming tomorrow into today.
Connected to MQ!
Twitter