I'd say the question is self-explanatory, but to give a bit of context to the sort of environment I'm talking about.
The scenario is that your webservers are being joined to the domain to make administration easier. Then, if we run the website as a domain user, we gain the ability to run define the connectionstrings as SSPI. Is it then valid (or more specifically, encourage/discouraged) to run the application pool as a domain user simply so that SSPI for the connection string will function.
Obviously, there are a few things that we would do here, such as reduced access to the domain user beyond the machine it's running on (non-interactive etc.), strong passwords, etc.
I appreciate that this doesn't really solve many security issues, it's just a question that came up and I've always considered it to be the wrong way. I'm looking for specific reasons why this shouldn't be done as it solves some of the issues we have (e.g. we cannot easily encrypt connection strings).