have a server where the machine.config states the following:
<machineKey validationKey="AutoGenerate,IsolateApps" decryptionKey="AutoGenerate,IsolateApps" validation="SHA1"/>
A decryption key was not specified, it was auto-generated. I’m moving this to a new server. How do I migrate the decryption and validation keys so that the database can be used on a new server?
Are these keys only used for Viewstate and Cookie Auth or are they used to generate the encrypted passwords?
They are autogenerated at runtime and can’t be migrated. It will only affect the auth tickets/Viewstate that are generated at runtime and not your stored passwords which should have their own salt stored separately from the hash in the DB.
Better to generate your own for the migration in case you need to add more servers in a farm.