Placed where IIS stores passwords:

  • C:\inetpub\wwwroot\web.config
  • C:\Windows\Microsoft.NET\Framework64\$SOME_VERSION_STRING\Config\web.config

Look for the connectionString directive.