Information
Authentication credentials should always be protected to reduce the risk of stolen authentication credentials. For security reasons, it is recommended that user credentials not be stored an any IIS configuration files.
NOTE : Nessus has not performed this query, and this check is only provided for informational purposes.
Solution
Authentication mode is configurable at the machine.config, root-level web.config, or application-level web.config:
1. Locate and open the configuration file where the credentials are stored
2. Find the <credentials> element
3. If present, remove the section
This will remove all references to stored users in the configuration files.