Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server where the machine.config states the following:

<machineKey validationKey="AutoGenerate,IsolateApps" decryptionKey="AutoGenerate,IsolateApps" validation="SHA1"/>

A decryption key was not specified, it was auto-generated. I'm moving this to a new server. How do I migrate the decryption and validation keys so that the database can be used on a new server?

share|improve this question
up vote 0 down vote accepted

It depends on how the ASP.NET application was written. If the built-in membership provider was used most likely you are out of luck because the membership provider uses the machine key each and every time to hash the passwords, assuming they are being hashed, alternatively they could just be encrypted.

It also uses the machine key for session state and view state encoding as well.

If the application has its own membership provider it may also not even take advantage of the machine key in which case you may be able to recover them. Either way it doesn't look good I'm afraid.

You should really get the developer to insert a custom machine key into the web.config file for the application, you would also have to do this if you ever planned on moving to a web farm as well.

share|improve this answer

I don't think you can, at least not unless you baked in code to read the machinekey values in your app.

I'm pretty sure the keys are only used to generate sessionids and that there should be no harm moving the app to a new server using the same database. This is based on the fact that the machinekeys are re-generated on app-pool restarts and such, and app pool restarts do not make previously stored passwords invalid (or so I hope).

There are more details on this topic in this blog post:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.