Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a 2 node web farm for testing (replicating my production environment). Now, after I install VS2010 on one of the nodes (one of the nodes doubles as a build server), it would seem as if the machine keys got desynched.

If I access my app on each node all works fine (from localhost, and taking the other node off the farm), but when I have both nodes in the array, I get http errors (500, 404s and 401s) on several of the page resources (I suspect the ones that get routed to the server that did not created the auth cookie), and I also get a bunch of "Length of the data to decrypt is invalid" exceptions. These leads me to believe the auth cookie generated by a server is not compatible with the other server and thus the machineKeys on the two nodes are different, but I can't figure out where!.

Some more info:

The machineKeys are specified in my apps web.config and are the same on both, and both have SHA1 algo

Both apps are running .net 2.0 framework ( 3.5 apps) with the same configuration in the pool.

Both servers are running w2k3 server with all updates installed, except that one of the servers has .net4.0 and VS2010 installed and the other does not.

None of the servers have a machine key specified in the global machine.config, so they should be using the web.config ones, right?

Any ideas on where to look next?

share|improve this question


I finally figured it out. As it turned out, one of the nodes did not have a critical update installed properly (KB2416470) through windows update. And as mention in Scott Gu's post here

Importantly – if your site or application is running across multiple web-servers in a web-farm, you’ll want to make sure the update is applied to all of the machines (and not just some of them). This is because the update changes the encryption/signing behavior of certain features in ASP.NET, and a mix of patched and un-patched servers will cause that encryption/signing behavior to be incompatible between them.

Installing the update manually solved the problem.

Hope this saves someone else some time.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.