It is good practice to change the Administrator password. You might want to be extra secure and also change the other accounts (service accounts).
You will notice that the web config file is encrypted when it comes to passwords.
You can use the following commands to encrypt/decrypt the file.
To decrypt run this command:
C:\AOSService\webroot\bin\Microsoft.Dynamics.AX.Framework.ConfigEncryptor.exe -decrypt C:\AOSService\webroot\web.config
To encrypt run this command:
C:\AOSService\webroot\bin\Microsoft.Dynamics.AX.Framework.ConfigEncryptor.exe -encrypt C:\AOSService\webroot\web.config
If you make changes you may need to reboot the machine. Restarting IIS didnt work for me when I changed the passwords.