Cool approach, you need to compromise two separate servers just to have a usable password database you could run tools against. A key compromise can be fixed quickly and a password compromise is useless without the key.
When breaking in, your end goal isn't the database server... it's the domain controller or the configuration management server.