I have two machines running windows OS with IIS and window OS with MS SQL. In the production web.config file I configure the IIS to use a user name and password when connecting to the DB and then I encrypt it with a key using RSA. The key will be generated using aspnet_regiis and exported into all IIS Machines. Each production server holds only the encrypted web.config file (and an imported key in the secured in the IIS).
The other approach will be to define in the web.config a connection using windows authentication. This will be a lot less work on my side.
Which practice is better ? Which is safer?