Password file in windows environment?

Question

I'm looking for a way to store a database password on the working machine so that my own application can read it (in order to connect to the database) but a user without administration rights cannot read it. It must be possible for an administrator to change the password, preferably automatically.

What I have in mind is something like the .pgpass file for PostgreSQL in a Linux environment. Is this possible in a Windows environment as well?

I think the password file can be made accessible for administrators only. But can a program, which is executable for the user, access this file as well? Further, is it possible with the help of group policies to distribute such a file via the network?

---

Other solutions that I'm thinking about (probably with more effort):

2. Encrypt the password file. Only the application and the administrators have the valid keys to decrypt and change / read the file.
3. Retrieve the password from a network resource, presumably encrypted as well.

Answer 1

In answer to your question about administrator access only-

Windows executes services with the user's permissions (unless you specifically run as administrator or a different user), so if the user doesn't have access to a file, neither will the program.

In answer to the group policy question-

Yes, you can use group policy to distribute files through Group Policy Preferences. (See: https://www.adamfowlerit.com/2016/07/group-policy-preferences-replace-existing-file/)

Answer 2

If anybody is interested: I came up with the following solution.

The password is stored encrypted in an XML file (the "password container"). The container can be opened and edited with an administrator password. The encryption is symmetric. The container is placed on a network ressource, simply within a network directory.

The application is given the location of the password container and is able to open the password container because the administrator password is deposited in the code.

I know that this solution is not 100% secure because passwords should not be stored in the code. However, for these requirements (the database password shall be hidden from the user, the database password must be administrable), the solution is good enough.