Well, technically the setting is not hidden, but it is quite misleading. We added a machine config setting that was meant to be the session state setting for all applications unless overridden in the web.config for that application. When you add a new application, the new application gets the setting from the Machine.config, however, it is not put in the web.config. It is on the properties->ASP.Net->Edit Configuration :: [New Popup]->State Management.
When I moved the server to a sub domain, I fixed the node in the machine.config and assumed I was done. On some sites (the ones that did not override the default), I was getting an “unable to connect to the database” error. So after checking all my connection strings over and over again, I noticed that I was getting a 500 error in firebug on the client. As with all non-descript 500 errors, I checked the event log. There it identified the session database as the issue. After checking the login and the url, I went into each web.config to see if there was a sessionstate node. When I checked the iis setting, VOILA – it was still pointing to the parent domain for the sql server (that had been moved to the sub domain).
In short, in iis 6, you have to manage session state individually and not rely on the global machine.config. What a waste of a full day 🙁
