title: Is storing a password in a Windows user environment variable bad practice?
body: <p>I recently read the the following SO question.</p>
  
  <p><a href="https://stackoverflow.com/questions/11232703/whats-the-best-way-to-store-a-password-or-private-key-on-a-web-host">What's the best way to store a password or private key on a web host?</a></p>
  
  <p>It mentions encrypted connection strings (for use in an ASP.NET app) or using the Data Protection API (DPAPI) at the time of this writing.  Both seem like good solutions for this user's particular use case.  </p>
  
  <p>However, traditionally I've always stored sensitive configuration values like passwords and connection strings in User Environment Variables on the server(s) they are being used on.  These are easy to define, change, and read (from an IT perspective).  They're also easy to access regardless of the framework or language used.</p>
  
  <p>The question is: Is it good practice to store sensitive data in windows user environment variables and if not, why?</p>
  
  <p>EDIT:</p>
  
  <p>Based on Ken's comments a pre-requisite question should be: Is the windows registry contents encrypted?</p>