Microsoft-Windows-MSMQ
Event ID 1: Message with ID MessageIDGUID\MessageIDIdentity was put into queue QueueName.
#Event ID 1: Message with ID MessageIDGUID\MessageIDIdentity was put into queue
#Description
Message with ID \ was put into queue.
Fields #
| Name | Description |
|---|---|
MessageIDGUID GUID | |
MessageIDIdentity UInt32 | |
QueueName UnicodeString |
Event ID 2: Message received
#Event ID 3: Message sent over network
#Event ID 4: Message came over network
#Event ID 5: Message with ID MessageIDGUID\MessageIDIdentity was sent to queue QueueName.
#Event ID 5: Message with ID MessageIDGUID\MessageIDIdentity was sent to queue
#Description
Message with ID \ was sent to queue.
Fields #
| Name | Description |
|---|---|
MessageIDGUID GUID | |
MessageIDIdentity UInt32 | |
QueueName UnicodeString |
Event ID 2000: The Message Queuing service cannot start
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2001: The Message Queuing service cannot start
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2015: The Message Queuing service is not online with Active Directory Domain Services
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2016: The Message Queuing service is not online with Active Directory Domain Services, since the service properties cannot be retrieved or set
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2020: The Message Queuing service cannot start
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2023: The Message Queuing service cannot start
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2024: The Message Queuing serivce performance counter data are not available
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2027: A corrupted packet was encountered.
#Description
Logged (Level 2, Error) by the Message Queuing service when it parses a malformed MSMQ wire-protocol packet. Observed on systems patched against CVE-2023-21554 (QueueJumper): the post-patch validation rejects the malformed packet and logs this event instead of the pre-patch out-of-bounds-write crash.
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
Level | eq | 2 | 1 rule | sigma |
Community Notes #
Matched by the SigmaHQ 'MSMQ Corrupted Packet Encountered' rule (Provider MSMQ, Level 2). Provenance is vendor-verified, not Microsoft-documented: the Randori / IBM X-Force team screenshotted this exact event from the MSMQ source while testing the CVE-2023-21554 patch. Note a historical id collision: the legacy KB810318 (MSMQ 1.0 on Windows NT4) assigned 2027 to an unrelated IPX-address message; that IPX message catalog predates the modern MSMQ rewrites and does not describe this event.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma # view in coverage
References #
Event ID 2028: The Message Queuing service started
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-MSMQ",
"guid": "{ce18af71-5efd-4f5a-9bd5-635e34632f69}",
"event_source_name": "MSMQ",
"event_id": 2028,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2026-03-13T20:00:50.493281+00:00",
"event_record_id": 3678,
"correlation": {},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "Application",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 2028: The Message Queuing service started
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-MSMQ",
"event_id": 2028,
"level": 4,
"task": 0,
"opcode": 0,
"time_created": "2026-03-13T20:00:50.4932819+00:00",
"computer": "JD-DC01-2022.ludus.domain",
"channel": "Application"
},
"event_data": {}
}
Event ID 2035: The Message Queuing service cannot start
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2043: The Message Queuing service deleted message 'param1'
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2044: The Message Queuing service has insufficient privileges to create audit log messages
#Event ID 2045: The Message Queuing down-level client support service has insufficient privileges to create audit log messages
#Event ID 2047: The Message Queuing service cannot start
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2048: The server cannot support the automatic recognition of sites and connected networks for down-level clients
#Event ID 2049: A multicast listener received a request with headers size exceeding the configured max size of 'MaxHeaderSize'
#Fields #
| Name | Description |
|---|---|
MaxHeaderSize UnicodeString | |
Frequency UnicodeString |
Event ID 2050: A multicast listener received a request with content-length header size of 'ReqBodySize' that exceeds the configured max size of 'MaxBodySize'
#Fields #
| Name | Description |
|---|---|
ReqBodySize UnicodeString | |
MaxBodySize UnicodeString | |
Frequency UnicodeString |
Event ID 2051: The Message Queuing service rejected a request since the deserialization hit the maximum allowed xml depth of 'MaxXmlDepth'
#Fields #
| Name | Description |
|---|---|
MaxXmlDepth UnicodeString | |
Frequency UnicodeString |
Event ID 2052: The request's deserialization led to a stack overflow exception in the Message Queuing service
#Fields #
| Name | Description |
|---|---|
MaxXmlDepth UnicodeString |
Event ID 2053: The incoming sequences checkpoint file failed to initialize
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2054: The Message Queuing service rejected an attempt to create a queue because the total number of queues has reached the maximum allowed limit of 'QueueCountLimit' This limit can be increased by creati...
#Fields #
| Name | Description |
|---|---|
QueueCountLimit UnicodeString |
Event ID 2055: The Message Queuing service session cleanup is taking longer than expected
#Fields #
| Name | Description |
|---|---|
QueueCountLimit UnicodeString |
Event ID 2059: The Message Queuing service cannot communicate with other computers, because the RPC interface cannot use the TCP/IP protocol
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2060: The Message Queuing service is online with Active Directory Domain Services and fully operational
#Event ID 2061: The Message Queuing service cannot start
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2064: The transactions checkpoint file failed to initialize
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2068: The list of Message Queuing servers with directory service functionality in the Windows registry is empty
#Event ID 2076: The logger files cannot be initialized
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2078: The Message Queuing service cannot start
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2079: The Message Queuing service cannot start
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2083: The Message Queuing service cannot start
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString | |
param4 UnicodeString |
Event ID 2084: The Message Queuing service cannot start because a queue is in an inconsistent state
#Event ID 2085: The message file 'param1' cannot be created
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2086: The message file 'param1' was successfully created
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2087: The Client Access License (CAL) limit was reached
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2095: Since an MSMQ 1
#Event ID 2096: The Message Queuing folder cannot be created
#Event ID 2097: The Message Queuing registry values cannot be read (the registry is probably corrupted)
#Event ID 2116: Message Queuing was unable to create the msmq (MSMQ Configuration) object in Active Directory Domain Services
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2117: Message Queuing was unable to load Mqupgrd
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2118: Message Queuing was unable to find the address of MqCreateMsmqObj in Mqupgrd
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2119: Message Queuing Setup cannot be completed
#Event ID 2120: The Message Queuing service was unable to obtain the properties of the msmq (MSMQ Configuration) object from Active Directory Domain Services
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2122: This domain controller is not trusted for delegation
#Event ID 2123: The Message Queuing server cannot determine if the local domain controller is trusted for delegation
#Event ID 2124: The Message Queuing service failed to join the computer's domain 'param3'
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2125: The Message Queuing service successfully joined the computer's domain 'param1'
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2126: Message Queuing left the domain and is now operating in workgroup mode
#Event ID 2127: Message Queuing objects cannot move automatically between domains (param1)
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2134: Message Queuing successfully moved to the param1 domain
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2135: The computer belongs to the param1 domain
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2139: Message Queuing detected a problem with the local domain controller
#Event ID 2140: This server was unable to resolve the IP addresses of other routing servers
#Event ID 2141: The properties of the queue param3 cannot be set
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString | |
param4 UnicodeString | |
param5 UnicodeString |
Event ID 2142: The properties of the queue param3 cannot be set
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString | |
param4 UnicodeString | |
param5 UnicodeString |
Event ID 2143: The Microsoft Distributed Transaction Coordinator (DTC) failed
#Event ID 2144: There is an inconsistency between the actual network addresses and the addresses that are listed on other Message Queuing servers for this computer
#Event ID 2145: The computer object for this computer was not found in Active Directory Domain Services, possibly because of Active Directory Domain Services replication delays
#Event ID 2147: The service cannot start due to insufficient disk space or memory
#Event ID 2148: The service cannot start due to its failure to connect to its device driver
#Event ID 2149: The Message Queuing directory service failed to update the directory service flag in Active Directory Domain Services at the end of the domain controller demotion process
#Event ID 2150: The Message Queuing directory service failed to update the directory service flag in Active Directory Domain Services during the domain controller promotion process
#Event ID 2151: Obsolete, kept for backward compatibility
#Event ID 2152: The Message Queuing directory service is not running as a local system
#Event ID 2153: Message Queuing Down-level Client Support cannot start
#Event ID 2154: A multicast listener initialization failed
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2155: The Message Queuing service stopped monitoring the mapping folder
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2156: The mapping file param3 was ignored
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2157: The mapping of the URL param1 to the queue param2 was ignored
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2158: The mapping file param1 was ignored because it was improperly formatted
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2159: Message Queuing Down-level Client Support started
#Event ID 2160: The queue cannot listen/bind to the multicast address
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2161: The mapping of the URL param1 to the queue param2 is ignored
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2162: Message Queuing Down-level Client Support failed to create the MSMQ Configuration (msmq) object with a given GUID for computer
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2163: The Message Queuing service stopped
#Event ID 2164: The Message Queuing service will not join the param1 domain
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2165: The sites where the computer resides cannot be resolved
#Event ID 2166: The Message Queuing service cannot join the 'param1' Windows NT 4
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2167: Message Queuing is operating in Hardened mode
#Event ID 2168: The Message Queuing service resource cannot bind to the cluster IP address
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2169: The local computer is a Message Queuing routing server that formerly belonged to the 'param1' domain and is now operating in workgroup mode
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2170: Message Queuing failed to bind to port 1801
#Event ID 2171: Message Queuing cannot bind to UDP port 3527
#Event ID 2172: The MsmqServices object is configured with weakened security to support MSMQ 1
#Event ID 2173: The MsmqServices object is configured with default security
#Event ID 2174: Message Queuing Down-level Client Support cannot operate in mixed mode
#Event ID 2175: Message Queuing will use an encryption key with an effective length of 40 bits when sending messages encrypted with the RC2 encryption algorithm
#Event ID 2176: Message Queuing found multiple IP addresses for the local computer
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2177: The Message Queuing service rejects incoming messages when it is unable to check whether the sender is allowed access to the queue for sending messages
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2181: Message Queuing cannot establish new connections to this computer because connection limit was reached
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2184: Message Queuing could not resolve the name 'param1' to an IP address
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2185: A socket operation failed with error
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2186: Message Queuing could not establish connection to param1, because the connection limit for this computer was reached
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2187: Message Queuing could not establish connection to param1, because connection was refused by the recipient computer
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2188: Message Queuing could not access Active Directory Domain Services and failed to compute routing path for messages sent to queue
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString | |
param4 UnicodeString |
Event ID 2189: Message Queuing failed to send a message due to low memory
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2190: Message Queuing could not complete SSL negotiation with the remote computer
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2191: Message Queuing could not validate server certificate in HTTPS scenario because the certificate was found in disallowed store
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2192: Message Queuing could not establish SSL connection with the recipient computer because a trust chain from the server certificate to a trusted Certificate Authority certificate could not be established
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2193: Message Queuing could not establish SSL connection with the recipient computer because the computer name specified in the HTTP queue format name does not match the name of the recipient server cert...
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2194: The Message Queuing service cannot communicate with other computers, because the select API for socket failed
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2195: Message Queuing could not authenticate a message sent to queue
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2196: Message Queuing failed to verify digital signature of a message sent to queue
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2197: Message Queuing failed to listen on the IPv6 protocol
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2198: Message Queuing failed to listen on the IPv4 protocol
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2199: Message Queuing Service failed to listen on both IPv4 and IPv6 protocol
#Event ID 2220: The IP address param1 specified in the \HKLM\Software\Microsoft\MSMQ\Parameters\param2 registry value is not a valid IP address for this computer
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString | |
param4 UnicodeString |
Event ID 2221: Message Queuing will use the IP address
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2224: The MSMQ VSS Writer object cannot be created
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2225: The MSMQ VSS Writer failed to register with the VSS
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2226: The MSMQ VSS Writer failed to identify itself
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2227: Backup failed during event
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2228: Restore failed during event
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2229: The MSMQ VSS Writer failed to handle the restore located at 'param3'
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString |
Event ID 2230: A backup (components: param1) was completed successfully
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString |
Event ID 2231: A restore was completed successfully
#Event ID 2232: The restore located at 'param1' was handled successfully
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2233: The MSMQ VSS Writer is disabled through the registry setting
#Event ID 2234: The restore located at 'param1' is invalid
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2250: Message Queuing will not be able to accept messages temporarily because system paged pool is low
#Event ID 2251: Message Queuing will not be able to accept messages temporarily because system commit is low
#Event ID 2252: Message Queuing is resuming accepting messages because the system memory usage has normalized
#Event ID 2253: The message could not be moved to deadletter queue
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString | |
param4 UnicodeString |
Event ID 2254: The message could not be moved to deadletter queue
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2255: The message could not be moved to deadletter queue
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 2256: The message could not be moved to deadletter queue
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString |
Event ID 1073743848: The Message Queuing serivce performance counter data are not available.
#Description
The Message Queuing serivce performance counter data are not available. The performance counter module failed to initialize. Please run 'lodctr.exe mqperf.ini' from the command console and restart the service, or contact Microsoft support. Error param1: param2
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 1073743852: The Message Queuing service started.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-MSMQ",
"event_id": 2028,
"level": 4,
"task": 0,
"opcode": 0,
"time_created": "2026-03-13T20:00:50.4932819+00:00",
"computer": "JD-DC01-2022.ludus.domain",
"channel": "Application"
},
"event_data": {}
}
Event ID 1073743884: The Message Queuing service is online with Active Directory Domain Services and fully operational.
#Event ID 1073743910: The message file 'param1' was successfully created.
#Event ID 1073743949: The Message Queuing service successfully joined the computer's domain 'param1'.
#Event ID 1073743950: Message Queuing left the domain and is now operating in workgroup mode.
#Event ID 1073743958: Message Queuing successfully moved to the param1 domain.
#Event ID 1073743959: The computer belongs to the param1 domain.
#Event ID 1073743983: Message Queuing Down-level Client Support started.
#Event ID 1073743987: The Message Queuing service stopped.
#Event ID 1073743991: Message Queuing is operating in Hardened mode.
#Event ID 1073743996: The MsmqServices object is configured with weakened security to support MSMQ 1.
#Description
The MsmqServices object is configured with weakened security to support MSMQ 1.0 clients. With weakened security, the Message Queuing Down-level Client Support service will use its own rights (under the LocalSystem account on a domain controller) to view object properties, but it will not bypass the security restrictions on creating Message Queuing objects and setting their properties.
Message #
Event ID 1073743997: The MsmqServices object is configured with default security.
#Description
The MsmqServices object is configured with default security. MSMQ 1.0 clients will not be able to query Active Directory Domain Services in this configuration.
Message #
Event ID 1073744000: Message Queuing found multiple IP addresses for the local computer.
#Description
Message Queuing found multiple IP addresses for the local computer. Message Queuing will use the default IP address determined by the PGM driver for multicast messages. To use a different IP address, set the \HKLM\Software\Microsoft\MSMQ\Parameters\param1 registry value to one of the following valid IP addresses: param2.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 1073744045: Message Queuing will use the IP address param1.
#Event ID 1073744054: A backup (components: param1) was completed successfully.
#Event ID 1073744055: A restore was completed successfully.
#Event ID 1073744056: The restore located at 'param1' was handled successfully.
#Event ID 1073744057: The MSMQ VSS Writer is disabled through the registry setting.
#Description
The MSMQ VSS Writer is disabled through the registry setting. Backup and restore support is not available. To enable the writer, please delete registry value DisableMsmqVSSWriter or set it to 0.
Message #
Event ID 1073744076: Message Queuing is resuming accepting messages because the system memory usage has normalized.
#Event ID 2147485691: The Message Queuing service deleted message 'param1'.
#Event ID 2147485692: The Message Queuing service has insufficient privileges to create audit log messages.
#Event ID 2147485693: The Message Queuing down-level client support service has insufficient privileges to create audit log messages.
#Event ID 2147485703: The Message Queuing service session cleanup is taking longer than expected.
#Message #
Event ID 2147485707: The Message Queuing service cannot communicate with other computers, because the RPC interface cannot use the TCP/IP protocol.
#Event ID 2147485735: The Client Access License (CAL) limit was reached.
#Description
The Client Access License (CAL) limit was reached. This server is unable to serve more clients. This may lead to messaging performance degradation. See the Windows documentation for information on how to increase your client license limit. This event is logged no more than once per param1 seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 |
Event ID 2147485771: The Message Queuing server cannot determine if the local domain controller is trusted for delegation.
#Description
The Message Queuing server cannot determine if the local domain controller is trusted for delegation. This may indicate a serious problem. For more information, see Help and Support Center.
Message #
Event ID 2147485787: Message Queuing detected a problem with the local domain controller.
#Description
Message Queuing detected a problem with the local domain controller. Until the problem is resolved, Message Queuing will function unpredictably. Using Event Viewer, inspect the directory service, File Replication Service, and system logs to help identify the problem.
Message #
Event ID 2147485788: This server was unable to resolve the IP addresses of other routing servers.
#Description
This server was unable to resolve the IP addresses of other routing servers. Please check that all computers are registered in DNS.
Message #
Event ID 2147485792: There is an inconsistency between the actual network addresses and the addresses that are listed on other Message Queuing servers for this computer.
#Description
There is an inconsistency between the actual network addresses and the addresses that are listed on other Message Queuing servers for this computer. If this computer belongs to an MSMQ 1.0 site, you should use MSMQ Explorer on the local primary site controller (PSC) to manually update the addresses listed for this computer.
Message #
Event ID 2147485800: The Message Queuing directory service is not running as a local system.
#Description
The Message Queuing directory service is not running as a local system. To get the directory service functionality, you need to run as a local system.
Message #
Event ID 2147485801: Message Queuing Down-level Client Support cannot start.
#Description
Message Queuing Down-level Client Support cannot start. This service can operate only on a domain controller. The service can be disabled by using Computer Management to change its startup type in the Properties dialog box from Automatic to Manual or Disabled.
Message #
Event ID 2147485805: The mapping of the URL param1 to the queue param2 was ignored.
#Event ID 2147485809: The mapping of the URL param1 to the queue param2 is ignored.
#Event ID 2147485810: Message Queuing Down-level Client Support failed to create the MSMQ Configuration (msmq) object with a given GUID for computer param1.
#Description
Message Queuing Down-level Client Support failed to create the MSMQ Configuration (msmq) object with a given GUID for computer param1. Creating MSMQ Configuration objects with given GUIDs may be required for Message Queuing clients during the setup of Windows NT 4.0 or Windows 9x computers and when a Windows 2000 computer joins a Windows Server 2003 (or later) domain. By default, an Active Directory Domain Services forest does not support adding an object with a supplied GUID. You can solve this problem by upgrading Message Queuing on the client computer to a version that does not require creating an object with a given GUID. There are also alternative solutions.
Message #
Fields #
| Name | Description |
|---|---|
param1 |
Event ID 2147485813: The sites where the computer resides cannot be resolved.
#Description
The sites where the computer resides cannot be resolved. Check that the subnets in your network are configured correctly in Active Directory Domain Services and that each site is configured with the appropriate subnet.
Message #
Event ID 2147485819: Message Queuing cannot bind to UDP port 3527.
#Description
Message Queuing cannot bind to UDP port 3527. Message Queuing's internal ping mechanism uses this port to establish network connections. Another process may be using this port. Message Queuing can continue to operate without using this port, but connection times will not be optimal. To optimize the establishment of connections, free this port and restart Message Queuing.
Message #
Event ID 2147485823: Message Queuing will use an encryption key with an effective length of 40 bits when sending messages encrypted with the RC2 encryption algorithm.
#Description
Message Queuing will use an encryption key with an effective length of 40 bits when sending messages encrypted with the RC2 encryption algorithm. To restore strong encryption, remove the registry value HKLM\Software\Microsoft\MSMQ\Parameters\Security\SendEnhRC2With40.
Message #
Event ID 2147485829: Message Queuing cannot establish new connections to this computer because connection limit was reached.
#Description
Message Queuing cannot establish new connections to this computer because connection limit was reached. There are too many computers attempting to send messages to or receive from this computer. This event is logged at most once per param1 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2181 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 |
Event ID 2147485830: Storage quota exceeded for MSMQ queue param1.
#Description
Storage quota exceeded for MSMQ queue param1. No more messages can be stored in the queue. You can increase a queue's storage quota by editing queue properties in Computer Management console. This event is logged at most once per param2 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2182 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 2147485831: Machine MSMQ storage quota was exceeded or there is insufficient disk space.
#Description
Machine MSMQ storage quota was exceeded or there is insufficient disk space. No more messages can be stored in user queues. You can increase Message Queuing storage quota or purge unneeded messages by using Computer Management console. This event is logged at most once per param1 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2183 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 |
Event ID 2147485832: Message Queuing could not resolve the name 'param1' to an IP address.
#Description
Message Queuing could not resolve the name 'param1' to an IP address. Try to ping the recipient computer, and check this computer's DNS settings. This event is logged at most once per param2 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2184 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 2147485833: A socket operation failed with error param1.
#Description
A socket operation failed with error param1. Next hop address is param2. Message Queuing cannot send the message now, but it will retry to send the message. This event is logged at most once per param3 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2185 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 | |
param3 |
Event ID 2147485834: Message Queuing could not establish connection to param1, because the connection limit for this computer was reached.
#Description
Message Queuing could not establish connection to param1, because the connection limit for this computer was reached. There too many computers trying to send to or receive messages from this computer. This event is logged at most once per param2 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2186 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 2147485835: Message Queuing could not establish connection to param1, because connection was refused by the recipient computer.
#Description
Message Queuing could not establish connection to param1, because connection was refused by the recipient computer. It is possible that Client Access Licenses (CALs) are exhausted (if the recipient is a Windows Server), or connection limit has been reached (if the recipient is a Windows workstation). This event is logged at most once per param2 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2187 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 2147485836: Message Queuing could not access Active Directory Domain Services and failed to compute routing path for messages sent to queue param3.
#Description
Message Queuing could not access Active Directory Domain Services and failed to compute routing path for messages sent to queue param3. Messages will wait in the outgoing queue until connection with Active Directory Domain Services is restored. This event is logged at most once per param4 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2188 registry value to desired time in seconds. Error param1: param2
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 | |
param3 | |
param4 |
Event ID 2147485837: Message Queuing failed to send a message due to low memory.
#Description
Message Queuing failed to send a message due to low memory. Message Queuing will retry to send the message. This event is logged at most once per param1 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2189 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 |
Event ID 2147485838: Message Queuing could not complete SSL negotiation with the remote computer.
#Description
Message Queuing could not complete SSL negotiation with the remote computer. It is possible that the server certificate is not properly installed, or that remote computer is not listening on port 443 (SSL). This event is logged at most once per param1 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2190 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 |
Event ID 2147485839: Message Queuing could not validate server certificate in HTTPS scenario because the certificate was found in disallowed store.
#Description
Message Queuing could not validate server certificate in HTTPS scenario because the certificate was found in disallowed store. This means the certificate cannot be trusted. This event is logged at most once per param1 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2191 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 |
Event ID 2147485840: Message Queuing could not establish SSL connection with the recipient computer because a trust chain from the server certificate to a trusted Certi...
#Description
Message Queuing could not establish SSL connection with the recipient computer because a trust chain from the server certificate to a trusted Certificate Authority certificate could not be established. This event is logged at most once per param3 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2192 registry value to desired time in seconds. Error param1: param2
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 | |
param3 |
Event ID 2147485841: Message Queuing could not establish SSL connection with the recipient computer because the computer name specified in the HTTP queue format name do...
#Description
Message Queuing could not establish SSL connection with the recipient computer because the computer name specified in the HTTP queue format name does not match the name of the recipient server certificate. This event is logged at most once per param1 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2193 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 |
Event ID 2147485843: Message Queuing could not authenticate a message sent to queue param1.
#Description
Message Queuing could not authenticate a message sent to queue param1. The message was rejected because the queue only accepts authenticated messages. It is possible that sender did not sign the message, or signed it with a self-signed certificate. A negative arrival acknowledgement will be sent if requested by the sender. This event is logged at most once per param2 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2195 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 2147485844: Message Queuing failed to verify digital signature of a message sent to queue param1.
#Description
Message Queuing failed to verify digital signature of a message sent to queue param1. The message was rejected. A negative arrival acknowledgement will be sent if requested by the sender. This event is logged at most once per param2 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2196 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 2147485845: Message Queuing failed to listen on the IPv6 protocol.
#Description
Message Queuing failed to listen on the IPv6 protocol. Messages will not be accepted on IPv6. If you want Message Queuing to accept messages on IPv6 protocol, please verify that the IPv6 protocol is installed and operational (Restarting the machine is required). Error param1: param2
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 2147485846: Message Queuing failed to listen on the IPv4 protocol.
#Description
Message Queuing failed to listen on the IPv4 protocol. Messages will not be accepted on IPv4. If you want Message Queuing to accept messages on IPv4 protocol, please verify that the IPv4 protocol is installed and operational (Restarting the machine is required). Error param1: param2
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 2147485872: The MSMQ VSS Writer object cannot be created.
#Event ID 2147485873: The MSMQ VSS Writer failed to register with the VSS.
#Event ID 2147485898: Message Queuing will not be able to accept messages temporarily because system paged pool is low.
#Description
Message Queuing will not be able to accept messages temporarily because system paged pool is low. During this period, machine quota will be set to 0. No manual intervention is required at this stage. Once memory utilization has normalized, Message Queuing will automatically resume accepting messages.
Message #
Event ID 2147485899: Message Queuing will not be able to accept messages temporarily because system commit is low.
#Description
Message Queuing will not be able to accept messages temporarily because system commit is low. During this period, machine quota will be set to 0. No manual intervention is required at this stage. Once memory utilization has normalized, Message Queuing will automatically resume accepting messages.
Message #
Event ID 2147485901: The message could not be moved to deadletter queue param3.
#Description
The message could not be moved to deadletter queue param3. Check that queue exists and users have permissions to send. The message was moved to the system transactional dead letter queue. This event is logged at most once per param4 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2253 registry value to desired time in seconds. Error param1: param2
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 | |
param3 | |
param4 |
Event ID 2147485902: The message could not be moved to deadletter queue param1.
#Description
The message could not be moved to deadletter queue param1. The deadletter queue is authenticated and the authenticity of the message could not be verified. The message will be moved to the system transactional dead letter queue. This event is logged at most once per param2 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2254 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 2147485903: The message could not be moved to deadletter queue param1.
#Description
The message could not be moved to deadletter queue param1. Deadletter queues should not require privacy of messages. The message will be moved to the system transactional dead letter queue. This event is logged at most once per param2 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2255 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 2147485904: The message could not be moved to deadletter queue param1.
#Description
The message could not be moved to deadletter queue param1. The deadletter queue needs to be transactional. The message will be moved to the system transactional dead letter queue. This event is logged at most once per param2 seconds. To change this setting, set \HKLM\Software\Microsoft\MSMQ\Parameters\Event2256 registry value to desired time in seconds.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 3221227473: The Message Queuing service cannot start.
#Event ID 3221227487: The Message Queuing service is not online with Active Directory Domain Services.
#Description
The Message Queuing service is not online with Active Directory Domain Services. The MSMQ Configuration object (msmq) ID stored in the registry value '\HKLM\SOFTWARE\Microsoft\MSMQ\Parameters\MachineCache\QMId' was found under the computer name 'param1' in Active Directory Domain Services. Please relocate this MSMQ Configuration object under the local computer name in Active Directory Domain Services. The service attempts to locate a matching MSMQ Configuration object every few minutes.
Message #
Fields #
| Name | Description |
|---|---|
param1 |
Event ID 3221227488: The Message Queuing service is not online with Active Directory Domain Services, since the service properties cannot be retrieved or set.
#Event ID 3221227492: The Message Queuing service cannot start.
#Event ID 3221227495: The Message Queuing service cannot start.
#Event ID 3221227507: The Message Queuing service cannot start.
#Event ID 3221227519: The Message Queuing service cannot start.
#Event ID 3221227520: The server cannot support the automatic recognition of sites and connected networks for down-level clients.
#Description
The server cannot support the automatic recognition of sites and connected networks for down-level clients. The problem might be caused by Active Directory Domain Services replication delay. Please restart MQDS service after replication completed.
Message #
Event ID 3221227521: A multicast listener received a request with headers size exceeding the configured max size of '%1'.
#Message #
Event ID 3221227522: A multicast listener received a request with content-length header size of '%1' that exceeds the configured max size of '%2'.
#Message #
Event ID 3221227523: The Message Queuing service rejected a request since the deserialization hit the maximum allowed xml depth of '%1'.
#Message #
Event ID 3221227524: The request's deserialization led to a stack overflow exception in the Message Queuing service.
#Message #
Event ID 3221227525: The incoming sequences checkpoint file failed to initialize.
#Event ID 3221227526: The Message Queuing service rejected an attempt to create a queue because the total number of queues has reached the maximum allowed limit of '%1' ...
#Message #
Event ID 3221227533: The Message Queuing service cannot start.
#Event ID 3221227536: The transactions checkpoint file failed to initialize.
#Event ID 3221227540: The list of Message Queuing servers with directory service functionality in the Windows registry is empty.
#Event ID 3221227548: The logger files cannot be initialized.
#Event ID 3221227550: The Message Queuing service cannot start.
#Description
The Message Queuing service cannot start. The checkpoint files cannot be recovered. To start the Message Queuing service without losing consistency, you must correct or recover corrupted checkpoint and log files. To start the service for emergency use (with a potential loss of data consistency), delete the files QMLog, MQTrans.lg1, MQTrans.lg2, MQInSeqs.lg1, and MQInSeqs.lg2 from the Msmq\Storage folder and add the DWORD registry key HKLM\Software\Microsoft\MSMQ\Parameters\LogDataCreated with a value of 0. Error param1: param2
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 3221227551: The Message Queuing service cannot start.
#Description
The Message Queuing service cannot start. The log file cannot be recovered. To start the Message Queuing service without losing consistency, you must correct or recover corrupted checkpoint and log files. To start the service for emergency use (with a potential loss of data consistency), delete the files QMLog, MQTrans.lg1, MQTrans.lg2, MQInSeqs.lg1, and MQInSeqs.lg2 from the Msmq\Storage folder and add the DWORD registry key HKLM\Software\Microsoft\MSMQ\Parameters\LogDataCreated with a value of 0. Error param1: param2
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 3221227555: The Message Queuing service cannot start.
#Event ID 3221227556: The Message Queuing service cannot start because a queue is in an inconsistent state.
#Description
The Message Queuing service cannot start because a queue is in an inconsistent state. For more information, see Microsoft Knowledge Base article 827493 at support.microsoft.com.
Message #
Event ID 3221227557: The message file 'param1' cannot be created.
#Event ID 3221227567: Since an MSMQ 1.
#Description
Since an MSMQ 1.0 primary site controller owns the queue, you must manually delete the queue from the MSMQ 1.0 site (use MSMQ Explorer running on an applicable the site controller).
Message #
Event ID 3221227568: The Message Queuing folder cannot be created.
#Event ID 3221227569: The Message Queuing registry values cannot be read (the registry is probably corrupted).
#Event ID 3221227588: Message Queuing was unable to create the msmq (MSMQ Configuration) object in Active Directory Domain Services.
#Event ID 3221227589: Message Queuing was unable to load Mqupgrd.
#Event ID 3221227590: Message Queuing was unable to find the address of MqCreateMsmqObj in Mqupgrd.
#Event ID 3221227591: Message Queuing Setup cannot be completed.
#Event ID 3221227592: The Message Queuing service was unable to obtain the properties of the msmq (MSMQ Configuration) object from Active Directory Domain Services.
#Description
The Message Queuing service was unable to obtain the properties of the msmq (MSMQ Configuration) object from Active Directory Domain Services. This may be caused by an Active Directory Domain Services replication delay. Please wait several minutes and then restart the Message Queuing service. Error param1: param2
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 3221227594: This domain controller is not trusted for delegation.
#Description
This domain controller is not trusted for delegation. Therefore, the Message Queuing server cannot run. See Help and Support Center for information about how to enable the "This computer is trusted for delegation" property.
Message #
Event ID 3221227596: The Message Queuing service failed to join the computer's domain 'param3'.
#Event ID 3221227599: Message Queuing objects cannot move automatically between domains.
#Event ID 3221227613: The properties of the queue param3 cannot be set.
#Event ID 3221227614: The properties of the queue param3 cannot be set.
#Event ID 3221227615: The Microsoft Distributed Transaction Coordinator (DTC) failed.
#Description
The Microsoft Distributed Transaction Coordinator (DTC) failed. The Message Queuing service cannot continue. Please restart the DTC and the Message Queuing service.
Message #
Event ID 3221227617: The computer object for this computer was not found in Active Directory Domain Services, possibly because of Active Directory Domain Services repli...
#Description
The computer object for this computer was not found in Active Directory Domain Services, possibly because of Active Directory Domain Services replication delays.
Message #
Event ID 3221227619: The service cannot start due to insufficient disk space or memory.
#Event ID 3221227620: The service cannot start due to its failure to connect to its device driver.
#Event ID 3221227621: The Message Queuing directory service failed to update the directory service flag in Active Directory Domain Services at the end of the domain cont...
#Description
The Message Queuing directory service failed to update the directory service flag in Active Directory Domain Services at the end of the domain controller demotion process.
Message #
Event ID 3221227622: The Message Queuing directory service failed to update the directory service flag in Active Directory Domain Services during the domain controller ...
#Description
The Message Queuing directory service failed to update the directory service flag in Active Directory Domain Services during the domain controller promotion process.
Message #
Event ID 3221227623: Obsolete, kept for backward compatibility
#Event ID 3221227626: A multicast listener initialization failed.
#Event ID 3221227627: The Message Queuing service stopped monitoring the mapping folder param3.
#Event ID 3221227628: The mapping file param3 was ignored.
#Event ID 3221227630: The mapping file param1 was ignored because it was improperly formatted.
#Event ID 3221227632: The queue cannot listen/bind to the multicast address param3.
#Event ID 3221227636: The Message Queuing service will not join the param1 domain.
#Description
The Message Queuing service will not join the param1 domain. An MSMQ Configuration (msmq) object exists in the new domain with an ID differing from the service ID. Please delete the MSMQ Configuration object in the new domain, restart the Message Queuing service, and log on again.
Message #
Fields #
| Name | Description |
|---|---|
param1 |
Event ID 3221227640: The Message Queuing service resource cannot bind to the cluster IP address.
#Description
The Message Queuing service resource cannot bind to the cluster IP address. This prevents the Message Queuing resource from coming online on this node. One possible reason is that the Message Queuing service running on the physical node was started before the computer became a member of the server cluster. As a result, the Message Queuing service running on the physical node listens on all IP addresses of the computer and prevents the Message Queuing resource from listening on the cluster IP address. To solve this problem, restart the Message Queuing service on the physical node. Error param1: param2
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 3221227641: The local computer is a Message Queuing routing server that formerly belonged to the 'param1' domain and is now operating in workgroup mode.
#Description
The local computer is a Message Queuing routing server that formerly belonged to the 'param1' domain and is now operating in workgroup mode. Other Message Queuing clients still regard this computer as a routing server and will try to route messages through this computer. To solve this problem, you need to manually delete the Message Queuing objects for this computer in Active Directory Domain Services. Please delete the following two objects: 1) The msmq object under the computer object of this computer in the Computers container in the Active Directory Users and Computers snap-in: 'CN=msmq,CN=param2,CN=computers,DC=param1,DC=...' 2) The MSMQ Settings object under the server object for this computer in the Active Directory Sites and Services snap-in: 'CN=MSMQ Settings,CN=param2,CN=Servers,CN=<SiteName>,CN=Sites,CN=Configuration,DC=...' You also need to uninstall Routing Support and Down-level Client Support by using Server Role Manager.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 |
Event ID 3221227642: Message Queuing failed to bind to port 1801.
#Description
Message Queuing failed to bind to port 1801. The port may already be bound to another process. Make sure that the port is free and try to start Message Queuing again. If this problem arises during setup, you must free the port and run setup again.
Message #
Event ID 3221227646: Message Queuing Down-level Client Support cannot operate in mixed mode.
#Description
Message Queuing Down-level Client Support cannot operate in mixed mode. Mixed mode is a transient mode in which Message Queuing deployment is in the middle of migration from MQIS (for MSMQ 1.0) to Active Directory Domain Services. In this mode, some sites are still Windows NT 4.0 sites and are mastered by the PEC and PSCs. Mixed mode might require creating/deleting/updating objects that belong to Windows NT 4.0 sites. These operations are not supported by Message Queuing Down-level Client Support. After completing the migration of all Windows NT 4.0 sites to Active Directory Domain Services (migration of the PEC and all PSCs in Windows NT 4.0 sites), Message Queuing will no longer be in mixed mode.
Message #
Event ID 3221227649: The Message Queuing service rejects incoming messages when it is unable to check whether the sender is allowed access to the queue for sending mess...
#Description
The Message Queuing service rejects incoming messages when it is unable to check whether the sender is allowed access to the queue for sending messages. In this case, the queue affected is param1, but note that an event might not be issued every time this problem occurs. To perform this access check, Message Queuing needs access to the TokenGroupsGlobalAndUniversal attribute of the sender's user object. Only users with domain administration permissions can add members to the Windows Authorization Access Group, which is allowed access to the TokenGroupsGlobalAndUniversal attribute, in one of two ways: 1) For best security practice, add only the computer accounts that need access to the TokenGroupsGlobalAndUniversal attribute to the Windows Authorization Access Group. The domain administrator will repeat this operation for other Message Queuing computers that require the permission, manually adding the relevant accounts to the Windows Authorization Access Group. 2) As a less secure practice, add the Authenticated Users group to the Windows Authorization Access group. This grants every authenticated user, including the Message Queuing service on any computer, access to the TokenGroupsGlobalAndUniversal attribute for all users, and requires no further manual administration.
Message #
Fields #
| Name | Description |
|---|---|
param1 |
Event ID 3221227666: The Message Queuing service cannot communicate with other computers, because the select API for socket failed.
#Event ID 3221227671: Message Queuing Service failed to listen on both IPv4 and IPv6 protocol.
#Description
Message Queuing Service failed to listen on both IPv4 and IPv6 protocol. Messages will not be accepted from the network through TCP/IP protocols. Messages addressed to this machine using TCP/IP protocols will not arrive but will accumulate in sender's outgoing queues. Please fix the TCP/IP protocols issue and restart the computer.
Message #
Event ID 3221227692: The IP address param1 specified in the \HKLM\Software\Microsoft\MSMQ\Parameters\param2 registry value is not a valid IP address for this computer.
#Description
The IP address param1 specified in the \HKLM\Software\Microsoft\MSMQ\Parameters\param2 registry value is not a valid IP address for this computer. The Message Queuing service will use the IP address param3 instead. Please remove this registry value or set it to one of the following valid IP addresses: param4.
Message #
Fields #
| Name | Description |
|---|---|
param1 | |
param2 | |
param3 | |
param4 |
Event ID 3221227698: The MSMQ VSS Writer failed to identify itself.
#Event ID 3221227699: Backup failed during event param3.
#Event ID 3221227700: Restore failed during event param3.
#Event ID 3221227701: The MSMQ VSS Writer failed to handle the restore located at 'param3'.
#Provenance
ETW provider GUID ce18af71-5efd-4f5a-9bd5-635e34632f69
Defined in mqutil.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3207, captured 2026-06-02 — Manifest XML pack, 1.9 MB