HRESULT 0xC00E007E (MQ_ERROR_CANNOT_GET_DN): meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

Obsolete, kept for backward compatibility

Previous	Next
MQ_ERROR_NO_MSMQ_SERVERS_ON_GC	MQ_ERROR_CANNOT_HASH_DATA_EX

MQ_ERROR_CANNOT_GET_DN

What this result actually narrows down

When MQ_ERROR_CANNOT_GET_DN appears, start with the queue operation and its property arrays rather than with a broad repair of the Message Queuing service. Interpret it as obsolete distinguished-name lookup condition, not as a general transport outage. The code is retained for compatibility with older directory integration.

For MQ_ERROR_CANNOT_GET_DN, validation occurs in layers: identifier recognition, variant type, buffer shape, value range, required companions, and operation eligibility. When diagnosing MQ_ERROR_CANNOT_GET_DN, these layers correspond to different MSMQ HRESULTs and different fixes.

When diagnosing MQ_ERROR_CANNOT_GET_DN, the property namespace is split among message, queue, computer, private-computer, and management properties. In the MQ_ERROR_CANNOT_GET_DN path, A numeric identifier meaningful in one structure is not automatically legal in another API.

MSMQ objects involved

Subsystem	MSMQ property arrays and their parallel identifier, value, and status elements
Decisive boundary	the property identifier, VARTYPE, value, operation, and buffer ownership are validated separately
Code-specific focus	obsolete distinguished-name lookup condition
Primary recovery rule	Use the actual LDAP/AD DS error from modern logs when available.

When diagnosing MQ_ERROR_CANNOT_GET_DN, do not merge this result with other property failures: identifier, VARTYPE, value, size, required companions, and operation eligibility are diagnosed by different codes. For MQ_ERROR_CANNOT_GET_DN, the code-specific boundary is obsolete distinguished-name lookup condition.

Triage data

The api name and whether the structure was input, output, or both; associate it explicitly with MQ_ERROR_CANNOT_GET_DN.
When diagnosing MQ_ERROR_CANNOT_GET_DN, the first failing property rather than only the aggregate hresult; capture the value before cleanup or retry changes it.
In the MQ_ERROR_CANNOT_GET_DN path, the complete apropid/apropvar/astatus triples in original order; compare it with a known-good call using the same account and queue type.
For this MQ_ERROR_CANNOT_GET_DN result, record the queue path or format name, local/remote placement, transactional flag, caller SID, process build, and UTC correlation ID when they apply.

For MQ_ERROR_CANNOT_GET_DN, log certificate thumbprints, provider names, SIDs, GUIDs, lengths, and hashes where useful, but do not log private keys, symmetric keys, credentials, or confidential message bodies.

A safe investigation order

Record the unsigned HRESULT, MQ_ERROR_CANNOT_GET_DN, and the native API or COM method before a framework replaces it with a generic exception.
When diagnosing MQ_ERROR_CANNOT_GET_DN, capture the first failing property rather than only the aggregate HRESULT.
In the MQ_ERROR_CANNOT_GET_DN path, capture the complete aPropID/aPropVar/aStatus triples in original order.
Reproduce with the smallest queue/message/property set that still returns MQ_ERROR_CANNOT_GET_DN; change one precondition at a time.
For MQ_ERROR_CANNOT_GET_DN, verify the postcondition after the failed call: queue existence, message presence, directory object state, transaction outcome, or generated output may differ by result.
When diagnosing MQ_ERROR_CANNOT_GET_DN, apply the code-specific recovery rule: Use the actual LDAP/AD DS error from modern logs when available.

Correct response

Use the actual LDAP/AD DS error from modern logs when available.

When diagnosing MQ_ERROR_CANNOT_GET_DN, do not hide this HRESULT behind an unlimited framework retry. In the MQ_ERROR_CANNOT_GET_DN path, require a verified precondition change and preserve the original correlation identifier across the next attempt.

What this code is not

In the MQ_ERROR_CANNOT_GET_DN path, changing a queue ACL or restarting the service does not correct an invalid identifier, VARTYPE, value, structure, or property combination. The specific focus for MQ_ERROR_CANNOT_GET_DN remains obsolete distinguished-name lookup condition.

In the MQ_ERROR_CANNOT_GET_DN path, granting broad queue or certificate permissions may mask the symptom while creating a security defect. For this MQ_ERROR_CANNOT_GET_DN result, test the exact identity and access needed by the operation.
For this MQ_ERROR_CANNOT_GET_DN result, changing queue names, deleting directory objects, or recreating certificates without reconciliation can create a second object while callers still reference the first.

Example failure path

A queue configuration service encounters MQ_ERROR_CANNOT_GET_DN. For MQ_ERROR_CANNOT_GET_DN, it logs the rejected property index and rebuilds the request from a typed schema instead of retrying the same arrays. When diagnosing MQ_ERROR_CANNOT_GET_DN, the acceptance test then changes only the decisive precondition and confirms both the HRESULT and the actual queue/message state.

A regression test should force MQ_ERROR_CANNOT_GET_DN, assert the raw value and relevant outputs, then correct only the documented precondition and verify the intended success or neighboring HRESULT.

Technical references

Microsoft: MQCreateQueue — source used for the MQ_ERROR_CANNOT_GET_DN analysis.
Microsoft: Message Queuing error and information codes — source used for the MQ_ERROR_CANNOT_GET_DN analysis.
Microsoft: queue properties and MQQUEUEPROPS — source used for the MQ_ERROR_CANNOT_GET_DN analysis.
Microsoft: MSMQ message properties — source used for the MQ_ERROR_CANNOT_GET_DN analysis.

Looking for a different code? Search another status or error code.