@powershell /nop /ex bypass "&{[Regex]::Replace([IO.File]::ReadAllText(file_full_path), '(?<=admin.*)admin', 'changepass')}"

sed 's/admin/changepass/2' file

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <configSections>
    <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net" />
    <section name="rewriter" requirePermission="false" type="Intelligencia.UrlRewriter.Configuration.RewriterConfigurationSectionHandler, Intelligencia.UrlRewriter" />
    <!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->
  </configSections>
  <rewriter configSource="WebRewriter.config" />
  <connectionStrings configSource="WebConnections.config" />
  <log4net configSource="WebLogging.config" />
  <appSettings configSource="WebSettings.config" />
  <system.web>
    <authentication mode="Forms">
      <forms loginUrl="~/service_config/Account/Login.aspx" timeout="2880">
        <credentials passwordFormat="Clear">
          <user name="admin" password="admin" />
        </credentials>
      </forms>
    </authentication>
    <compilation debug="true" targetFramework="4.5">
    </compilation>
    <httpModules>
      <add type="Intelligencia.UrlRewriter.RewriterHttpModule, Intelligencia.UrlRewriter" name="UrlRewriter" />
    </httpModules>
    <pages controlRenderingCompatibilityVersion="4.0" />
    <caching>
      <outputCacheSettings>
        <outputCacheProfiles>
          <!--test-->
          <add name="10seconds" duration="10" varyByHeader="Accept" varyByParam="guid" />
        </outputCacheProfiles>
      </outputCacheSettings>
    </caching>
  </system.web>
</configuration>

<user name="admin" password="admin" />

<user name="admin" password="smenapass" />