Microsoft Message Queue Topology by NTCMD or UDA Job
This job discovers the settings and relationships of triggers, rules, and queues.
MS MQ Queue Discovery
-
Registry Branch
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\Parameters /v StoreReliablePath
-
Command Output
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\Parameters StoreReliablePath REG_SZ C:\WINDOWS\system32\msmq\storage -
Regular Expression Patterns
Base parent folder for message storage
"\s*StoreReliablePath\s+REG_SZ\s+(.+)"
-
Command
dir /B /A:-D <ms mq queue settings folder>
-
Command Output
dir /B /A:-D C:\WINDOWS\system32\msmq\storage\lqs 00000002.990736e8 00000003.6ab7c4b8 00000004.4c1eb11b 00000006.e2f46f06 00000010.d1c14377 00000012.e6d243aa 9b0b035bf61b429d845bbd61740403b7.0d0d6ec1
-
Result
The file names of MS MQ queue configurations are retrieved. DFM then iterates against this list of files, reads them, and parses the queue settings.
-
Command
type <full_path_to_the_file>
-
Command Output
type C:\WINDOWS\system32\msmq\storage\lqs\00000002.990736e8 [Properties] Label=private$\admin_queue$ Type=00000000-0000-0000-0000-000000000000 QueueName=\private$\admin_queue$ Journal=00 Quota=4294967295 Security=010007805c0000006800000000000000140000000200
48000300000000018003f000e0001020000000000052000000020
02000000001400240002000101000000000001000000000000140
00400000001010000000000050700000001010000000000051200
0000010100000000000512000000 JournalQuota=4294967295 CreateTime=1259681363 BasePriority=32767 ModifyTime=1259681363 Authenticate=00 PrivLevel=1 Transaction=00 SystemQueue=01 Signature=DoronJ -
Parse Rules
Queue name:
".*QueueName\s*=\s*(.+?)\n.*"
Is transactional:
".*Transaction\s*=\s*(\d+).*"
Queue type (public/private):
"^[\\]*(private).*$" against Queue name
Message limit:
".*\s+Quota\s*=\s*(\d+).*"
Is journal enabled:
".*Journal\s*=\s*(\d+).*"
Journal limit:
".*JournalQuota\s*=\s*(\d+).*"
MS MQ Trigger Discovery
-
Registry Branch
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\Triggers\Data\Triggers\
-
Command Output
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\Triggers
\Data\Triggers\31b8e2c4-f412-431e-9b2c-517f7e5031d7 Name REG_SZ Test Trigger Queue REG_SZ msmq-vm2\Test Queue Enabled REG_DWORD 0x1 Serialized REG_DWORD 0x0 MsgProcessingType REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\
Triggers\Data\Triggers\31b8e2c4-f412-431e-9b2c-517f7e5031d7\AttachedRules Rule0 REG_SZ 9c172d69-c832-453e-826b-4415b7d0dfef HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\
Triggers\Data\Triggers\728b0d45-531d-4887-9762-3191b0069bb1 Name REG_SZ remote Trigger Queue REG_SZ msmq-vm01\Test Queue Enabled REG_DWORD 0x1 Serialized REG_DWORD 0x0 MsgProcessingType REG_DWORD 0x0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\
Triggers\Data\Triggers\728b0d45-531d-4887-9762-3191b0069bb1\AttachedRules Rule0 REG_SZ 9c172d69-c832-453e-826b-4415b7d0dfef HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\
Triggers\Data\Triggers\b900d598-e3c2-4958-bf21-c8c99ed264e2 Name REG_SZ qqqqqqq Queue REG_SZ msmq-vm2\private$\Private Test Queue Enabled REG_DWORD 0x1 Serialized REG_DWORD 0x0 MsgProcessingType REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\
Triggers\Data\Triggers\b900d598-e3c2-4958-bf21-c8c99ed264e2\AttachedRules Rule0 REG_SZ 9c172d69-c832-453e-826b-4415b7d0dfef HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\
Triggers\Data\Triggers\dc4302f0-d28c-40e4-a19a-492dcee231fe Name REG_SZ Test2 Queue REG_SZ msmq-vm2\private$\Test Transactional Enabled REG_DWORD 0x1 Serialized REG_DWORD 0x1 MsgProcessingType REG_DWORD 0x2 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\
Triggers\Data\Triggers\dc4302f0-d28c-40e4-a19a-492dcee231fe\AttachedRules Rule0 REG_SZ 9c172d69-c832-453e-826b-4415b7d0dfef Rule1 REG_SZ 2874c4c1-57f1-4672-bbdd-0c16f17788cf
MS MQ Rule Discovery
-
Regular Expression Patterns
The output buffer is split by the following regular expression:
"(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\
Triggers\Data\Triggers\[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\
-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12})\s*\n"After each string buffer is split, the following patterns are applied:
Trigger name:
".*Name\s+REG_SZ\s+(.*?)\n.*"
Trigger GUID:
" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\Triggers\ Data\Triggers\([0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\
-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12})\s*\n"Assigned queue:
".*Queue\s+REG_SZ\s+(.*?)\n.*"
Trigger is serialized:
".*Serialized\s+REG_DWORD\s+0x(\d+).*"
Trigger is enabled:
".*Enabled\s+REG_DWORD\s+(0x\d+).*"
Trigger message processing type:
".*MsgProcessingType\s+REG_DWORD\s+(0x\d+).*"
Trigger assigned rule GUID:
".*Rule\d+\s+REG_SZ\s+([0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\
-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}).*" -
Registry Branch
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\Triggers\Data\Rules\
-
Command Output
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\Triggers\Data\Rules\ 2874c4c1-57f1-4672-bbdd-0c16f17788cf Name REG_SZ Test Rule2 Description REG_SZ bla bla ImplementationProgID REG_SZ MSQMTriggerObjects.MSMQRuleHandler Condition REG_SZ $MSG_PRIORITY_EQUALS=1
$MSG_LABEL_DOES_NOT_CONTAIN=bla Action REG_SZ EXE C:\WINDOWS\system32\calc.exe ShowWindow REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\Triggers\Data\Rules\ 9c172d69-c832-453e-826b-4415b7d0dfef Name REG_SZ Test Rule Description REG_SZ ImplementationProgID REG_SZ MSQMTriggerObjects.MSMQRuleHandler Condition REG_SZ $MSG_LABEL_CONTAINS=Test Action REG_SZ EXE C:\WINDOWS\NOTEPAD.EXE ShowWindow REG_DWORD 0x1 -
Regular Expression Patterns
The output buffer is split by the following constant:
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\Triggers\Data\Rules\"
After each string buffer is split, the following patterns are applied:
Rule name:
".*Name\s+REG_SZ\s+(.*?)\n.*"
Rule condition:
".*Condition\s+REG_SZ\s+(.*?)\n.*"
Rule action:
".*Action\s+REG_SZ\s+(.*?)\n.*"
Rule GUID:
"\s*([0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\
-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}).*"
