Will the users of your application be connecting to your SQL server or is the intent for them to connect to their own server?
The following presumes they will be connecting to your server:
Hard coding the connection string makes it a little harder to find, but unless you're encrypting it somehow, it would show up if the application file was scanned for text.
Some form of light encryption along with hard coding makes the connection information non-trivial to find, but it would be even more secure if the connection the program used was NOT an administrator connection for the server.
There might be other connection types available that might not require the program to have a user name and password. (I'm thinking windows authentication, but that might not always be available or might not be a viable option.)