Windows Server security permissions

Installation of IBM MQ behaves differently on Windows Server, depending on whether a local user or domain user performs the installation.

If a local user installs IBM MQ, the Prepare IBM MQ Wizard detects that the local user created for the IBM MQ Windows service can retrieve the group membership information of the installing user. The Prepare IBM MQ Wizard asks the user questions about the network configuration to determine whether there are other user accounts defined on domain controllers running on Windows 2000 or later. If so, the IBM MQ Windows service needs to run under a domain user account with particular settings and authorities. The Prepare IBM MQ Wizard prompts the user for the account details of this user as described in Configure IBM MQ with the Prepare IBM MQ Wizard.

If a domain user installs IBM MQ, the Prepare IBM MQ Wizard detects that the local user created for the IBM MQ Windows service cannot retrieve the group membership information of the installing user. In this case, the Prepare IBM MQ Wizard always prompts the user for the account details of the domain user account for the IBM MQ Windows service to use.

When the IBM MQ Windows service needs to use a domain user account, IBM MQ cannot operate correctly until this has been configured using the Prepare IBM MQ Wizard. The Prepare IBM MQ Wizard does not allow the user to continue with other tasks, until the Windows service has been configured with a suitable account.

For more information, see Create and setting up domain accounts for IBM MQ.