IIS 7 Tip # 10 You can generate machine keys from the IIS manager

The machineKey element of the ASP.NET web.config specifies the algorithm and keys that ASP.NET will use for encryption. By default the validationKey and the decryptionKey keys are set to AutoGenerate which means the runtime will generate a random key for use. This works fine for applications that are deployed on a single server. When you use webfarms a client request can land on any one of the servers in the webfarm. Hence you will have to hardcode the validationKey and the decryptionKey on all your servers in the farm with a manually generated key.

There are a lot of articles that describe how to use RNGCryptoServiceProvider to generate a random key. There are also a lot of online tools that generate random keys for you. But I would suggest writing your own script because any one who has access to these keys can do evil things like tamper your forms authentication cookie or viewstate.

With IIS 7 you no longer have to do this manually. The IIS 7.0 manager has a built in feature that you can use to generate these keys.


It uses RNGCryptoServiceProvider internally to create a random key. The value is stored locally in the web.config of that application something like

<?xml version="1.0" encoding="UTF-8"?>
        <machineKey decryptionKey="F6722806843145965513817CEBDECBB1F94808E4A6C0B2F2,IsolateApps" validationKey="C551753B0325187D1759B4FB055B44F7C5077B016C02AF674E8DE69351B69FEFD045A267308AA2DAB81B69919402D7886A6E986473EEEC9556A9003357F5ED45,IsolateApps" />

You can copy it and paste it in the web.config file of all the servers in the webfarm.

Bookmark and Share

Comments (13)
  1. Thank you for submitting this cool story – Trackback from DotNetShoutout

  2. IIS 7 Tip # 10 You can generate machine keys from the IIS manager たけはらさんのBlog経由の情報。 IIS7の管理ツールからマシンキーの生成ができるんですね。…

  3. gOODiDEA.NET says:

    Web The Evolution of a Website Design Twitter from ASP.NET IIS 7 Tip # 10 You can generate machine keys

  4. gOODiDEA says:


  5. Prakash says:

    Great post but you can generate Online Machine key as well.

    It offers various algorithms to select for encryption and decryption..


  6. Peluang Usaha says:

    hehehehe, ana baru tahu ne, tks bro

    <a href="wisataumrah.com/">Peluang Usaha</a>

  7. Peluang Usaha says:

    hehehehe, ana baru tahu ne, tks bro


  8. JoinSyariah says:

    tks for information, i can do

    <a href="joinsyariah.com


  9. sroney says:

    Thanks – This saved a bunch of time.

  10. Ian Miller says:

    Thanks for doing this.  It's a heck of lot more straight forward than any other method I've seen (e.g. support.microsoft.com/…/2915218 ).  I put a comment at the bottom of that KB saying they should simply use your method if you are a sysadmin.  The method in the KB article is ok if you are automating the process.  However, many sysadmins dis-allow any kind of scripting on a production server which is a problem if you need to run a PS script.

    Thanks again!

  11. admin@infoumrohhaji.com says:

    thanks for the info .. visit me http://www.infoumrohhaji.com/

  12. mr box says:

    Thanks, does IsolateApps corresponds to "each application"?


Comments are closed.

Skip to main content