IIS Informant: Passwords for IUSR and IWAM

Learn how to determine the password for the IUSR and IWAM accounts that IIS installation creates.

Brett Hill

June 17, 2001

1 Min Read
ITPro Today logo in a gray background | ITPro Today


How can I determine the password for the IUSR and IWAM accounts that IIS installation creates?

The passwords for these accounts reside in the user account database (i.e., SAM) on Windows 2000 (without Active Directory—AD) and Windows NT 4.0 or in AD on Win2K domain controllers (DCs). As a result, obtaining passwords from those data stores is a severe breach of security. Although you can obtain those passwords by using a few tools, you don't have to work that hard because the passwords also reside in the metabase. Enter the script that Listing 1 shows in a text editor such as Notepad, then save the script as getpass.vbs (any name will do as long as it ends .vbs). When you execute the script, you'll see the username and password of the default IUSR and IWAM accounts.

Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like