Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a application I've recently ported From IIS6 (Windows 2003) (7 Classic Pipeline) to IIS7 (Windows 2008) Integrated Pipeline.

The problem I've noticed is password hashes built on the IIS6 system no longer match when we try to log in on the IIS7 system. However, when we re-generate the hash on the IIS7 system, it works fine.

I read somewhere that there are differences in the cryptographic systems between the two (2003/2008) and thier respective IIS versions, but I couldn't find any additional information.

I'm at a loss here, I need existing hashes to work on the new system and I can't seem to find an starting point.

If anyone knows of any resources that may help with this, or a setting or something, I'd be greatly appreciative.

share|improve this question
Can you expand on what you're using to generate the hashes? – Kev Mar 26 '11 at 11:16

Many Cryptography functions in .NET rely on the machineKey, that can be stored in web.config or machine.config. If you need multiple or other IIS servers to be able to encrypt/decrypt the same shared data, all the servers must be configured to use the same machineKey.

"If you use the membership feature, password hashes are stored in the membership database by default. The membership system also supports encrypted passwords. If you select encrypted password format, then the <machineKey> settings are used when encrypting and decrypting the data."

If you have already specified the machineKey, there may be an issue with the default algoritm, which was a breaking change in .Net 4.0. The default is now SHA256; you may need to change this back to SHA1 on the machineKey validation attribute, and also specify the hashAlgorithmType on the membership section:

  <membership defaultProvider="myMembership" hashAlgorithmType="SHA1">

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.