I recently experienced a problem with a DotNetNuke 04.05.01 portal installation where its MachineKey setting seemingly reset by itself. This prevented all users from logging into the website until the original MachineKey was restored.

My question is how is it possible that the MachineKey can be reset without performing an upgrade or install?

My understanding is that the MachineKey setting in the web.config is only reset when Install.aspx is called during an upgrade process. I checked the IIS web logs and did not see any specific request for Install.aspx at the time when the web.config had its MachineKey setting changed so this seems very strange to me. I can tell that the code in the Install.aspx.vb code behind file ran because a new backup of the web.config was made in the Config\Backup_YYYYMDhhmm folder. How is this possible???

How can this code be triggered to run? I'm worried that there is a way for a hacker to trigger resetting the MachineKey on my portal. I have disabled the AutoUpdate setting in the web.config, but I have no idea if this will help.

Any assistance would be much appreciated

Thanks