title: Securing IIS AppPool identity password
body: <p>Context:
  I'm trying to use a custom windows account for application pool, and enable Oracle OS authentication so that we would not have to store DB username and password in a config file.</p>
  
  <p>Problem:
  This setup works, however, I've noticed that I am able to 'recover' password using <code>appcmd.exe</code>. Is there a way to make sure someone with administrative and physical access cannot read the password in plain text?</p>
  
  <p>This is a Windows 2016 machine, IIS 10. Password <em>looks</em> encrypted when looking into <code>applicationHost.config</code> file.
  Following command shows the password:</p>
  
  <pre><code>%systemroot%\system32\inetsrv\appcmd.exe list apppool "ImoAppPool" /text:*
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/BaOc0.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/BaOc0.png" alt="enter image description here"></a></p>