1

Context: I'm trying to use a custom windows account for application pool, and enable Oracle OS authentication so that we would not have to store DB username and password in a config file.

Problem: This setup works, however, I've noticed that I am able to 'recover' password using appcmd.exe. Is there a way to make sure someone with administrative and physical access cannot read the password in plain text?

This is a Windows 2016 machine, IIS 10. Password looks encrypted when looking into applicationHost.config file. Following command shows the password:

%systemroot%\system32\inetsrv\appcmd.exe list apppool "ImoAppPool" /text:*

enter image description here

Nikola Radosavljević
  • 6,871
  • 32
  • 44
  • Possible duplicate of [IIS application pool identity account passwords shown in clear text](https://stackoverflow.com/questions/16706273/iis-application-pool-identity-account-passwords-shown-in-clear-text) – Michael Mar 13 '19 at 16:09

0 Answers0