Securing IIS AppPool identity password
<p>Context:
I'm trying to use a custom windows account for application pool, and enable Oracle OS authentication so that we would not have to store DB username and password in a config file.</p>

<p>Problem:
This setup works, however, I've noticed that I am able to 'recover' password using <code>appcmd.exe</code>. Is there a way to make sure someone with administrative and physical access cannot read the password in plain text?</p>

<p>This is a Windows 2016 machine, IIS 10. Password <em>looks</em> encrypted when looking into <code>applicationHost.config</code> file.
Following command shows the password:</p>

<pre><code>%systemroot%\system32\inetsrv\appcmd.exe list apppool "ImoAppPool" /text:*
</code></pre>

<p><a href="https://i.stack.imgur.com/BaOc0.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/BaOc0.png" alt="enter image description here"></a></p>