How can I prevent username and password from being displayed when my impersonation account is locked?
<p>I'm currently hosting a web application written in VB.NET 4. the app uses impersonation which stores a username and password in the web.config. My problem is when the impersonate account is locked (which takes down the site), the site displays an error page with a stack trace revealing the username and password in clear text.</p>

<p>Custom error messages are set to off so I'm not sure why this is happening.  I don't have the option of encrypting this portion of the web.config because we have a staging server that replicates to the production server, and the encryption keys are different on each server.</p>

<p>Entry in the web.config that is being displayed: </p>

<pre><code>&lt;identity impersonate="true" userName="test\myservice.account" password="123"/&gt;
&lt;machineKey validationKey="11111111" decryptionKey="222222222" validation="SHA1"/&gt;
</code></pre>
