Get a List of IIS Application Paths by Username

I am running this command to set credentials for a couple of iis applications.

Set-WebConfiguration "/system.applicationHost/sites/site[@name='Default Web Site']/application[@path='/Webapp']/virtualdirectory[@path='/']" -Value @{userName=$user;password=$password}

I need to update the password for over 15 apps with the same username? How can I use 'Get-Webconfiguration" (or any other method) to search for all application paths that uses userName=$user?

Here is a nudge, can view the info using the below commands. If the IIS: drive is not mapped you may have to Import-Module WebAdministration first.
These credentials appear to be clear text so careful who accessing scripts etc.

(Get-ItemProperty IIS:\\AppPools\TestAppPoolIdentity -Name ProcessModel).Username
(Get-ItemProperty IIS:\\AppPools\TestAppPoolIdentity -Name ProcessModel).Password