Yeah, I figured there's no One True Way :-)

The applications are run from various network locations, so I can assume that the user will be connected to the internal network. There aren't very many per-user preferences; mostly it's application configuration items, such as "where does this app find its database, and how does it connect?".

There are definitely secure configuration items, such as database passwords. I can trust that the users aren't going to use network sniffing tools or password crackers (I think!), but I wouldn't want the data to be accessible in plaintext or in an easily-readable database location.

Perhaps I should use a centrally-located configuration file that has some sort of basic encryption on it...