Change IIS .config password (Encryption?)

Question

The previous account that was used to log into a config file that allowed our site to run was deleted. I have absolutely no knowledge of IIS, and was looking for some insight on how to encrypt my password like the previous user had. I believe this is the encryption type <add name="IISWASOnlyRsaProvider...". Later on in the code I provided my own username and password that allowed it to run again:

virtualDirectory path="/" physicalPath="C:\path\to" userName="" password="" />
<virtualDirectory path="/Pictures" physicalPath="C:\Shares\Public\pictures" userName="" password="" />

The previous password started with enc:AesProvider and was followed by the encrypted password. Is there a way to generate my own encrypted password to place in the above location?

Answer 1

Open the virtual directory in IIS Manager, click Advanced Settings... in the Action pane on the right. On the entry Physical Path Credentials click the ... button and set the user and password. It will be stored in the config file.

Please note, that while the encryption for the password itself is strong, every administrator on the machine can view it very easily.

Example for a vDir foo in the root of the Default Web Site:

Get-WebConfiguration -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.applicationHost/sites/site[@name='Default Web Site']/application[@Path='/']/virtualDirectory[@path='/foo']" | select username, password

This uses the same API that IIS uses to get the username and password from the configuration. While in the config the password is encrypted, when reading it through the API it comes out in clear-text.

Answer 2

You may use the aspnet_regiis.exe command to encrypt the required section(s) of the configuration file, and grant access to the required account(s) that need to read it.

http://blogs.msdn.com/b/gaurav/archive/2013/12/16/encrypting-section-of-config-file-using-aspnet-regiis-exe-the-configuration-for-physical-path-web-config-cannot-be-opened.aspx

Answer 3

As an alternative to Peter's method with Powershell, you can also use appcmd to retrieve the password

%systemroot%\system32\inetsrv\APPCMD list vdirs mySite/Pictures /text:password

or to set a new one

%systemroot%\system32\inetsrv\APPCMD set vdir mySite/Pictures /password:"hunter2"

This may not work for some encryption methods. It depends on which accounts have access to the keys.