If you have the latest trial version of WMQ, you are working with v7.1 QMgr. Starting with version v7.1, WMQ will only allow non-privileged remote connections. To connect to the administrator account, you must disable restrictions or, even better, define a new channel for administrative connection and authenticate it.
On Windows, the biggest problem is that WMQ authenticates domain identifiers and must look for its groups. One of the most common problems when working with WMQ in a corporate environment is that it tries to find an identifier or group and does not have domain rights for this. Domain accounts, even those with local administrator rights, often fail because they do not have access to the query in the SAM domain for group searches. It contains an entire section of Infocenter that describes the requirements for Windows accounts.
The workaround for this for a developer - only environment is to create a local administrator account, then log in and create QMgr. Or make sure that the default MUSR_MQADMIN has local administrator rights and login rights. Again, you have to log in with an account to do this job, because you never need to look for an account in Active Directory, because it goes to the local SAM database. Again, this is only for development! In the Production section, you want to use a real domain account and give it the correct access rights to search for SAM, but DO NOT make it a local administrator, as described in the Infocenter section above.
Assuming you were able to create QMgr, then create a new channel and allow it to accept your local connections using an administrator account:
runmqsc * Define the channel, anyone connecting runs as MUSR_MQADMIN DEFINE CHL('DOTNET.SVRCONN') CHLTYPE(SVRCONN) MCAUSER(' MUSR_MQADMIN@hostname ') * Override default block-list - channel now allows ANYBODY SET CHLAUTH('DOTNET.SVRCONN') TYPE(BLOCKUSER) USERLIST('nobody') * Block access from ALL IP addresses SET CHLAUTH('DOTNET.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('*') USERSRC(NOACCESS) WARN(NO) ACTION(ADD) * Allow access from local host only SET CHLAUTH('DOTNET.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('127.0.0.1') USERSRC(CHANNEL) ACTION(ADD) END
Now you have a channel that will accept local connections ONLY, map them to the administrator account and then redefine the security that prevents administrative accounts from connecting remotely. Using an administrator account means that no queuing or QMgr authorization is required, and an account that is a local administrator means that there is no problem finding a domain. MCAUSER('MUSR_MQADMIN) converts each remote identifier into a local administrator identifier so that WMQ does not need to find remote identifiers. The mapping rule restricts connections to the local host only. Anyone who can connect to the channel will have a local administrator on the box with the ability to remotely execute OS code, so if you want to accept connections from other users, we recommend their authentication with certificates.