Passwords are on the server because of LDAP, it's a domain controller and even if you break in, you can't see them. There's a good chance they are using Windows Server and ActiveDirectory, so that means Remote Desktop must be also active. If you have the local admin password, you might try it with RD on some servers if you know their names.