IIS application pool identity account passwords shown in clear text

Question

When I use the appcmd list appool /text:* command, it shows me the application pool identity passwords in clear text. I am able to view

Answer 1

Unless something has changed, the answer is no. The principal is best stated by Raymond Chen:

'It's like saying that somebody's home windows are insecure because a burglar could get into the house by merely unlocking and opening the windows from the inside. (But if the burglar has to get inside in order to unlock the windows...)'.

The point in summary, is that anyone that can get to your IIS server or can execute a WMI command remotely against your server, or can execute a powershell command against your server has access.

They are assumed to be admins, and are assumed to be trusted, as occassionally admins would need to pull passwords for recovery purposes, or adding nodes to a shared pool if proper notes or password management wasn't done [mainly needed when doing basic authentication on a domain cluster needing shared passwords].

Answer 2

The passwords are only decrypted if you run appcmd as Administrator. If you run as a normal account, you get back the encrypted string.

This will be something like [enc:IISSomethingProvider:…:enc], just as you find it in applicationHost.config.