Code
//本类使用对象适配器模式修改系统默认设置,使单个IIS中多个应用程序共用同一状态session
    public class CustomOutOfProcSessionStateStore : SessionStateStoreProviderBase
    {
        private SessionStateStoreProviderBase _sessionStateStore = null;

        public OutOfProcSessionStateStore()
        {
            Assembly assembly = Assembly.GetAssembly(typeof(System.Web.SessionState.HttpSessionState));
            _sessionStateStore = 
                (SessionStateStoreProviderBase)assembly.CreateInstance("System.Web.SessionState.OutOfProcSessionStateStore");
        }

        public override void Initialize(string name, System.Collections.Specialized.NameValueCollection config)
        {
            _sessionStateStore.Initialize(name, config);

            Type storeType = _sessionStateStore.GetType();
            //系统指定默认路径变量名称
            string baseUriName = "s_uribase";
            //获取系统默认路径设置
            string oldBaseUri = (string)storeType.InvokeMember(baseUriName, 
                BindingFlags.GetField | BindingFlags.NonPublic | BindingFlags.Static,
                null, 
                null, 
                new object[] { }
                );
            //指定系统ApplicationId,这里的888就是IIS中的网站标识符
            string appId = "/LM/W3SVC/888/ROOT";
            //获取配置加密key
            string hashKey = (string)typeof(System.Web.Configuration.MachineKeySection).InvokeMember("HashAndBase64EncodeString", 
                BindingFlags.InvokeMethod | BindingFlags.NonPublic | BindingFlags.Static,
                null, 
                null, 
                new object[] { appId }
                );
            //获取新的session检索基路径
            string newBaseUri = appId + "(" + hashKey + ")/";
            //修改系统默认路径设置
            storeType.InvokeMember(baseUriName,
                BindingFlags.SetField | BindingFlags.NonPublic | BindingFlags.Static, 
                null, 
                null, 
                new object[] { newBaseUri }
                );

            base.Initialize(name, config);
        }

        public override SessionStateStoreData CreateNewStoreData(HttpContext context, int timeout)
        {
            return _sessionStateStore.CreateNewStoreData(context, timeout);
        }

        public override void CreateUninitializedItem(HttpContext context, string id, int timeout)
        {
            _sessionStateStore.CreateUninitializedItem(context, id, timeout);
        }

        public override void Dispose()
        {
            _sessionStateStore.Dispose();
        }

        public override void EndRequest(HttpContext context)
        {
            _sessionStateStore.EndRequest(context);
        }

        public override SessionStateStoreData GetItem(HttpContext context, string id, out bool locked, out TimeSpan lockAge, out object lockId, out SessionStateActions actions)
        {
            return _sessionStateStore.GetItem(context, id, out locked, out lockAge, out lockId, out actions);
        }

        public override SessionStateStoreData GetItemExclusive(HttpContext context, string id, out bool locked, out TimeSpan lockAge, out object lockId, out SessionStateActions actions)
        {
            return _sessionStateStore.GetItemExclusive(context, id, out locked, out lockAge, out lockId, out actions);
        }

        public override void InitializeRequest(HttpContext context)
        {
            _sessionStateStore.InitializeRequest(context);
        }

        public override void ReleaseItemExclusive(HttpContext context, string id, object lockId)
        {
            _sessionStateStore.ReleaseItemExclusive(context, id, lockId);
        }

        public override void RemoveItem(HttpContext context, string id, object lockId, SessionStateStoreData item)
        {
            _sessionStateStore.RemoveItem(context, id, lockId, item);
        }

        public override void ResetItemTimeout(HttpContext context, string id)
        {
            _sessionStateStore.ResetItemTimeout(context, id);
        }

        public override void SetAndReleaseItemExclusive(HttpContext context, string id, SessionStateStoreData item, object lockId, bool newItem)
        {
            _sessionStateStore.SetAndReleaseItemExclusive(context, id, item, lockId, newItem);
        }

        public override bool SetItemExpireCallback(SessionStateItemExpireCallback expireCallback)
        {
            return _sessionStateStore.SetItemExpireCallback(expireCallback);
        }
    }

<sessionState 
    mode="Custom" 
    cookieless="false" 
    timeout="15" 
    stateConnectionString="tcpip=ip:端口" 
    customProvider="OutOfProcSessionProvider" 
    stateNetworkTimeout="300">
    <providers>
       <add name="OutOfProcSessionProvider" type="CustomOutOfProcSessionStateStore"/>
    </providers>
</sessionState>

<machineKey  
 validationKey="78AE3850338BFADCE59D8DDF58C9E4518E7510149C46142D7AAD7F1AD49D95D4"  
 decryptionKey="5FC88DFC24EA123C"
 validation="SHA1"/>