You can simplify the administration of MSMQ access control by creating one or more global groups for administrators. For example, you might create one global group for Enterprise Admins and Site Admins global groups for each site.
The Enterprise Admins group should have administrator privileges on each Windows NT Server used as an MSMQ server (this privilege must be granted with User Manager for Domains). This group should also be granted Full Control permissions on the MSMQ enterprise, each site, each CN, and each computer used as an MSMQ server. (These permissions can be granted through MSMQ Explorer.)
A Site Admins group should have administrator privileges on each Windows NT Server used as an MSMQ server within the site. This group should also be granted Full Control permissions on the site and each computer used as an MSMQ server within the site. (These permissions can be granted through MSMQ Explorer.)
Using these groups, Enterprise Admins can install and configure an MSMQ server in any site, as well as install PSCs. Site Admins can install and configure BSCs and MSMQ routing servers within a site, but cannot create new sites.