Placed where IIS stores passwords:

• C:\inetpub\wwwroot\web.config
• C:\Windows\Microsoft.NET\Framework64\$SOME_VERSION_STRING\Config\web.config

Look for the connectionString directive.