Is it good UX practice to have a site generate secure random passwords for users and send it to their email or is it better to have them enter their own one each time?
It really depends on the context this account is being created. Typically, if it's a forum account for example, I would prefer to set my own password as I have a generic password assigned for that category of sites. In this case, having a password generated would mean that I would need to change it when I log in, which I would most likely forget unless it is required. This adds frustration later on when I decide I want to come back and find that I have to dig up the original email or retrieve my password.
On the other hand, if I were creating a batch users for an organization on Google Apps, having the option to generate passwords would be handy.
A pattern that I prefer is to send the user an email with a link to create a password that only works for a short period of time. Whenever I receive a password, I cut and paste it into the password field. If it automatically asks me for a new password then what's the point of having a temporary password? If it doesn't prompt for a password change, then I lost incentive to create a password because I'm logged in already. Then I would have the password in clear text in my email, which is a security hazzard.
Sending the link to reset the password automatically avoids these issues.
No. Because people will forget it because it will be random and hard to remember. So some of them will change it quickly to something they will remember. If they delete that email, most probably in the future they forget the password and have to use the 'forget password' link and go through the whole process to change it to one they remember easily or retrieve it.
So why not let the user pick their password upfront?
No, never generate a password!
Why? Just because this site in whatever context is (hopefully) going to be an often visited site, and users always want to choose their own passwords. If the user is given a generated password, the user might think there is a chance that it is a poorly built website. Most web users today are used to choosing their own password. And you never EVER send a password over the unsecure smtp- and pop-protocol. It could be read by anyone having the slightest knowledge. There are even free downloadable sniffing tools around to pick up password sent through e-mail.
Second, the site itself is just a very small part of the users total Internet experience having 10+ sites where username/password applies. If all of those sites used a generated password, the user would lose half of the passwords in a month's time, and you would have to deal with forgotten password administration instead of improving content. Keep It Simple Stupid (KISS-methodology) applies.
Even better, use Open ID, such as Google or Facebook or any other to make it even more simple for the user. Like StackExchange sites. Ever found yourself in need to ask for a lost password here? You've got it by now. :)