To recover password of SharePoint Farm, you need to log on with a Local Administrator account on a server with Central Administration. To recover passwords for Web Applications or services you need to log on with Administrator account to server where it is running.

For Central Admin, that would be:

• SharePoint Central Administration v4

But we can also uncover the passwords for other Application Pools, e.g.:

• SharePoint – 80
• SharePoint Web Applications
• e4b4b94050634ad2863ad7d7d17c3a17

Next, at the command prompt (or PowerShell) you can use the IIS appcmd.exe to request the Password field from the ProcessModel section of the applicationHost.config file.

For example, in console or PowerShell. Write code in single line!:

&$env:windir\\system32\\inetsrv\\appcmd.exe list apppool "SharePoint Central Administration v4" /text:ProcessModel.Password

An example run is shown below:

The password will be stored in c:\Test.txt.