# Configuring Windows Accounts

Before you begin
Note: If you are currently installing or configuring WebSphere® MQ, and you need your domain administrator to give you a special account to use, send this whole page to your administrator, as follows:

- Right-click this page and click Select All
- Right-click again and click Copy
- Paste into the body of a note in your e-mail application

About this task

WebSphere MQ has a component, running as a Windows® service, that checks that any user account attempting to access WebSphere MQ is authorized. As part of the check, the service must query which groups the account is a member of. The service itself runs under a local user account (MUSR_MQADMIN) created by WebSphere MQ at installation.

If you are using Windows 2000 or Windows 2003 on any domain controller on your network, it can be set up such that local user accounts do not have authority to query the group membership of its domain user accounts - this will prevent WebSphere MQ from completing its check, and access will fail. To handle this:

- Each installation of WebSphere MQ on the network must be configured to run its service under a domain user account that has the required authority (see the instructions below for creating one).
- Note: If an installer carries on anyway and configures WebSphere MQ without a special account, many or all parts of WebSphere MQ will not work, depending upon the particular user accounts involved, as follows:
  - An installer currently logged on with a Windows 2000 or Windows 2003 domain user account will not be able to complete the Default Configuration, and the Postcard and API Exerciser will not work.
  - WebSphere MQ connections to queue managers running under Windows 2000 or Windows 2003 domain accounts on other computers may fail.
  - Typical errors include "AMQ8066: Local mqm group not found" and "AMQ8079: Access was denied when attempting to retrieve group membership information for user 'abc@xyz' ".

The detailed instructions that follow guide a domain administrator to:

1. Create a global or universal domain group and give members of this group the authority to query the group membership of any account
2. Create one or more user accounts, and add them to the group
3. Repeat Step 2 to Step 4 for each domain
4. Use the accounts to configure each installation of WebSphere MQ
5. Set the password expiry periods.

The following information is aimed at Domain Administrators. Repeat Steps 2 to 4 below for each domain that has user names that will install WebSphere MQ, to create an account for WebSphere MQ on each domain:

1. Create a domain group with a special name that is known to WebSphere MQ and give members of this group the authority to query the group membership of any account:
   On Windows 2000 Server:
   1. Log on to the domain controller as an account with domain administrator authority.
   2. From the Start menu, open Active Directory Users and Computers.
   3. Find the domain name in the navigation pane on the left, right-click it and select New Group.
   4. Type `domain mqm` (this exact string should be used because it is understood and used by WebSphere MQ).
   5. In Group scope select either Global or Universal.
   6. In Group type select Security, and click OK.
   7. Find the domain name in the navigation pane on the left, right-click it and select Delegate Control..., then click Next.
   8. At Selected Groups and Users, press Add, select domain mqm then click Add. Click OK.
   9. Select domain mqm and click Next.
   10. Select Create a custom task to delegate and click Next.
   11. Select Only the following objects in the folder, and then check User Objects in the alphabetical list. Click Next.
   12. Check Property-specific, then select from the list (it is in alphabetical order on the second word) the following options:
       - Read Group Membership
       - Read Group MembershipSAM
   13. Click OK to close each window.
   On Windows 2003 Server:
   1. Log on to the domain controller as an account with domain administrator authority.
   2. From the Start menu, open Active Directory Users and Computers.
   3. Find the domain name in the navigation pane on the left, right-click it and select New Group.
   4. Type `domain mqm` (this exact string should be used because it is understood and used by WebSphere MQ).
   5. In Group scope select either Global or Universal.
   6. In Group type select Security, and click OK.
   7. View Active Directory Users and Computers in Advanced Features mode.
   8. Find the domain name in the left panel, right-click the domain name, then click Properties.
   9. Click the Security tab.
   10. Click Advanced.
   11. Click Add, then type `domain mqm` and click OK. A new dialog is displayed.
   12. Click the Properties tab.
   13. In the Apply onto box, change the view to User objects.
   14. Select the allow check box for the following options:
       - Read Group Membership
       - Read Group MembershipSAM
   15. Click OK to close each window.
2. Create one or more accounts, and add them to the group:
   1. In Active Directory Users and Computers, create a user account with a name of your choosing and add it to group "domain mqm".
   2. Repeat for all the accounts you want to create.
3. Repeat Steps 1 and 2 for each domain that has user names that will install WebSphere MQ, to create an account for WebSphere MQ on each domain.
4. Use the accounts to configure each installation of WebSphere MQ:
   1. Either use the same domain user account (as created in Step 1 above) for each installation of WebSphere MQ, or create a separate account for each one, adding each to the "domain mqm" group.
   2. When you have created the account(s), give one to each person configuring an installation of WebSphere MQ, who should enter the account details (domain name, user name and password) into the Prepare WebSphere MQ Wizard. Give them the account that exists on the same domain as their installing userid.
   3. When you install WebSphere MQ on any computer on the domain, the WebSphere MQ install program detects the existence of the "domain mqm" group on the LAN, and automatically adds it to the local "mqm" group. (The local "mqm" group is created during installation; all user accounts in it have authority to use WebSphere MQ). Thus all members of the "domain mqm" group will have authority to use WebSphere MQ on this computer.
   4. However, you do still need to provide a domain user account (as created in Step 1 above) for each installation, and configure WebSphere MQ to use it when making its queries. The account details should be entered into the Prepare WebSphere MQ Wizard that runs automatically at the end of installation (the wizard can also be run at any time from the start menu).
5. Set the password expiry periods:
   - If you use just one account for all users of WebSphere MQ, consider making the password of the account never expire, otherwise all instances of WebSphere MQ will stop working at the same time when the password expires.
   - If you give each user of WebSphere MQ their own user account you will have more user accounts to create and manage, but only one instance of WebSphere MQ will stop working at a time when the password expires.
   If you set the password to expire, warn the users that they will see a message from WebSphere MQ each time it expires - the message warns that the password has expired, and describes how to reset it.

For more information, see the System Administration Guide.

Parent topic: Configuring WebSphere MQ accounts in the Prepare WebSphere MQ Wizard