Home
%3CLINGO-SUB%20id%3D%22lingo-sub-333251%22%20slang%3D%22en-US%22%3EFinding%20app%20pool%20passwords%20on%20Windows%20Server%202003%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-333251%22%20slang%3D%22en-US%22%3E%0A%20%26lt%3Bmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text%2Fhtml%3B%20charset%3DUTF-8%22%20%2F%26gt%3B%3CSTRONG%3E%20First%20published%20on%20MSDN%20on%20Apr%2011%2C%202012%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%3CP%3EI%20was%20recently%20tasked%20with%20changing%20a%20password%20on%20a%20lightly%20used%20web%20application%20running%20on%20IIS6%20on%20Windows%20Server%202003.%20Of%20course%20I%20didn%E2%80%99t%20know%20what%20the%20current%20password%20was.%20I%20did%20a%20bit%20of%20Bing%E2%80%99ing%20and%20couldn%E2%80%99t%20find%20a%20way%20to%20get%20the%20password%20for%20Windows%20Server%202003.%20There%20were%20plenty%20of%20answers%20for%202008%20and%20later.%20(Appcmd.exe)%26nbsp%3B%20After%20a%20little%20bit%20of%20digging%20I%20finally%20came%20up%20with%20an%20answer.%20You%20can%20use%20AdsUtil.exe%20with%20the%20enum_all%20parameter.%20The%20output%20lists%20the%20passwords%20in%20plain%20text.%20It%20dumps%20a%20lot%20of%20data%2C%20so%20you%E2%80%99ll%20want%20to%20dump%20the%20info%20to%20a%20text%20file.%3C%2FP%3E%0A%20%20%3CP%3E%3CA%20href%3D%22http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Fms525006.aspx%22%20title%3D%22http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Fms525006.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Fms525006.aspx%20%3C%2FA%3E%3C%2FP%3E%0A%20%0A%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-333251%22%20slang%3D%22en-US%22%3EFirst%20published%20on%20MSDN%20on%20Apr%2011%2C%202012%20I%20was%20recently%20tasked%20with%20changing%20a%20password%20on%20a%20lightly%20used%20web%20application%20running%20on%20IIS6%20on%20Windows%20Server%202003.%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-333251%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIIS%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft
First published on MSDN on Apr 11, 2012

I was recently tasked with changing a password on a lightly used web application running on IIS6 on Windows Server 2003. Of course I didn’t know what the current password was. I did a bit of Bing’ing and couldn’t find a way to get the password for Windows Server 2003. There were plenty of answers for 2008 and later. (Appcmd.exe)  After a little bit of digging I finally came up with an answer. You can use AdsUtil.exe with the enum_all parameter. The output lists the passwords in plain text. It dumps a lot of data, so you’ll want to dump the info to a text file.

http://msdn.microsoft.com/en-us/library/ms525006.aspx