You don't have to create new accounts or passwords.

1. Copy the roles from the config-store\security\roles
2. Copy the .json files for the users (not the lock files) from config-store\security\users
3. Copy users and roles to the same directories on the new server.
4. Make sure that on the new server the same roles exist. I had trouble with the roles remaining associated to the users. So there might be a bit of administration work on your end.
5. Once you copied the roles and the users, log in as admin and double check the accounts.
6. If they are associated to the role, then ArcGIS server recognizes the encrypted password and it doesn't need to be changed.
7. If they are not, then you'll need to re-associate them, then ArcGIS server recognizes the encrypted password and it doesn't need to be changed.

You don't have to create new accounts or passwords.

1. Copy the roles from the config-store\security\roles
2. Copy the .json files for the users (not the lock files) from config-store\security\users
3. Copy users and roles to the same directories on the new server.
4. Make sure that on the new server the same roles exist. I had trouble with the roles remaining associated to the users. So there might be a bit of administration work on your end.
5. Once you copied the roles and the users, log in as administrator and double check the accounts.
6. If they are associated to the a role, then ArcGIS server recognizes the encrypted password and it doesn't need to be changed.
7. If they are not, then you'll need to re-associate them, then ArcGIS server recognizes the encrypted password and it doesn't need to be changed.