What does HRESULT 0xC00E0072 (MQ_ERROR_CANNOT_GRANT_ADD_GUID) mean?

MQ_ERROR_CANNOT_GRANT_ADD_GUID

Why the exact HRESULT matters

MQ_ERROR_CANNOT_GRANT_ADD_GUID belongs to the Message Queuing HRESULT facility, but its useful meaning is narrower than a generic messaging failure. In this case the decisive subject is directory permission required for supplied object GUID is unavailable. Creating MSMQ objects with caller-supplied GUIDs needs a specific AD DS control right.

For MQ_ERROR_CANNOT_GRANT_ADD_GUID, MSMQ uses directory services for public queues, machine configuration, security metadata, routing, aliases, and related enterprise objects. When diagnosing MQ_ERROR_CANNOT_GRANT_ADD_GUID, private/direct queue operation can therefore succeed while a directory-dependent action fails.

When diagnosing MQ_ERROR_CANNOT_GRANT_ADD_GUID, global catalog searches and writes to a writable domain naming context have different capabilities. In the MQ_ERROR_CANNOT_GRANT_ADD_GUID path, record whether the operation was discovery, read, create, update, or delete before choosing a domain controller.

Subsystem context

When diagnosing MQ_ERROR_CANNOT_GRANT_ADD_GUID, A queue can exist locally while its public registration or MSMQ configuration object is absent, stale, wrong-class, or visible only on some domain controllers. For MQ_ERROR_CANNOT_GRANT_ADD_GUID, the code-specific boundary is directory permission required for supplied object GUID is unavailable.

Minimum useful telemetry

• Domain/workgroup mode, forest and domain names, and selected domain controller; associate it explicitly with MQ_ERROR_CANNOT_GRANT_ADD_GUID.
• When diagnosing MQ_ERROR_CANNOT_GRANT_ADD_GUID, dns and ldap reachability plus the distinguished name being accessed; capture the value before cleanup or retry changes it.
• In the MQ_ERROR_CANNOT_GRANT_ADD_GUID path, the directory object class, guid, owner, and replication state; compare it with a known-good call using the same account and queue type.
• For this MQ_ERROR_CANNOT_GRANT_ADD_GUID result, record the queue path or format name, local/remote placement, transactional flag, caller SID, process build, and UTC correlation ID when they apply.

For MQ_ERROR_CANNOT_GRANT_ADD_GUID, log certificate thumbprints, provider names, SIDs, GUIDs, lengths, and hashes where useful, but do not log private keys, symmetric keys, credentials, or confidential message bodies.

Step-by-step diagnosis

1. Record the unsigned HRESULT, MQ_ERROR_CANNOT_GRANT_ADD_GUID, and the native API or COM method before a framework replaces it with a generic exception.
2. When diagnosing MQ_ERROR_CANNOT_GRANT_ADD_GUID, capture domain/workgroup mode, forest and domain names, and selected domain controller.
3. Reproduce with the smallest queue/message/property set that still returns MQ_ERROR_CANNOT_GRANT_ADD_GUID; change one precondition at a time.
4. For this MQ_ERROR_CANNOT_GRANT_ADD_GUID result, verify the postcondition after the failed call: queue existence, message presence, directory object state, transaction outcome, or generated output may differ by result.
5. For MQ_ERROR_CANNOT_GRANT_ADD_GUID, capture the directory object class, GUID, owner, and replication state.
6. When diagnosing MQ_ERROR_CANNOT_GRANT_ADD_GUID, apply the code-specific recovery rule: Delegate the narrow right on the correct container or let AD DS assign the GUID.

Retry and cleanup

Delegate the narrow right on the correct container or let AD DS assign the GUID.

When diagnosing MQ_ERROR_CANNOT_GRANT_ADD_GUID, do not hide this HRESULT behind an unlimited framework retry. In the MQ_ERROR_CANNOT_GRANT_ADD_GUID path, require a verified precondition change and preserve the original correlation identifier across the next attempt.

Avoiding a false diagnosis

In the MQ_ERROR_CANNOT_GRANT_ADD_GUID path, local private-queue success does not prove that public-queue registration, global catalog discovery, or the required AD DS object is healthy. The specific focus for MQ_ERROR_CANNOT_GRANT_ADD_GUID remains directory permission required for supplied object GUID is unavailable.

• In the MQ_ERROR_CANNOT_GRANT_ADD_GUID path, A successful test under an interactive administrator account does not prove that the production service account has the same profile, token, directory access, or key permissions.
• For this MQ_ERROR_CANNOT_GRANT_ADD_GUID result, restarting MSMQ before collecting evidence can invalidate handles and erase the first useful event; it is a containment action, not a root-cause diagnosis.

Example

A public-queue discovery service encounters MQ_ERROR_CANNOT_GRANT_ADD_GUID. For MQ_ERROR_CANNOT_GRANT_ADD_GUID, it compares DNS, LDAP bind, object class, and replication on the exact domain controller used by MSMQ. When diagnosing MQ_ERROR_CANNOT_GRANT_ADD_GUID, the acceptance test then changes only the decisive precondition and confirms both the HRESULT and the actual queue/message state.

Automated coverage should preserve the original arrays/identities, confirm that cleanup is safe after MQ_ERROR_CANNOT_GRANT_ADD_GUID, and test that a retry does not duplicate messages or directory objects.

References

• Microsoft: Message Queuing error and information codes — source used for the MQ_ERROR_CANNOT_GRANT_ADD_GUID analysis.
• Microsoft Open Specifications: MSMQ and directory services — source used for the MQ_ERROR_CANNOT_GRANT_ADD_GUID analysis.
• Microsoft Open Specifications: MSMQ protocols overview — source used for the MQ_ERROR_CANNOT_GRANT_ADD_GUID analysis.
• IETF RFC 4511: LDAP protocol — source used for the MQ_ERROR_CANNOT_GRANT_ADD_GUID analysis.
• Microsoft: destination queues — source used for the MQ_ERROR_CANNOT_GRANT_ADD_GUID analysis.

Looking for a different code? Search another status or error code.