Вот одно из решений:

if (CheckBoxRememberMe.Checked) { 
  int version = 2;
  string name = userName;
  DateTime issueDate = DateTime.Now;
  DateTime expiration = DateTime.Now.AddDays(50);
  bool isPersistent = true;
  string userData = "to be found out";//language could go here 
  string cookiePath = FormsAuthentication.FormsCookiePath; 
  //Create a custom FormsAuthenticationTicket containing application specific data for the user. 
  FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(version, name, issueDate, expiration, isPersistent, userData, cookiePath); 
  //Encrypt the ticket. 
  string encryptedTicket = FormsAuthentication.Encrypt(ticket); 
  //Create the cookie. 
  Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket)); 
  //Redirect back to original URL. 
  Response.Redirect(FormsAuthentication.GetRedirectUrl(userName, isPersistent)); 
} else { 
  //TODO: Set create cookie to true or false, research a little more. 
  FormsAuthentication.RedirectFromLoginPage(userName, false); 
}

А для сессии будет действовать timeout из секции forms(web.config)

В принципе никто не запрещает управлять куками из кода..

HttpCookie myCookie = new HttpCookie("UserSettings");
myCookie["Font"] = "Arial";
myCookie["Color"] = "Blue";
myCookie.Expires = DateTime.Now.AddDays(30);
Response.Cookies.Add(myCookie);