When Windows machines are part of an Active Directory domain, Kerberos is used to manage authentication. With Kerberos, the domain controller is the game master: everybody trust it, and none other. Which means that when the Web site connects to the database, the machine which contains the Web site (let's call it "WWW") talks to the domain controller ("DC") and uses a secret value, stored in the entrails of WWW, to convince DC that it is exactly that machine, sane and sound of spirit and body: the secret value is accessible only to the most privileged process in WWW.
Once DC is convinced, it honours the request from WWW which is: "give me a ticket which I can show to the database, proving that I am user 'SomeDomain\SomeAccount' trying to connect to the database under that name". That ticket is the result of a cryptographic computation that the database server (DB) will verify by talking to the DC ("Is this ticket valid right now ?"). Tickets embed a timeout and are short-lived.
What does it mean for our problem ? It means that an attacker obtaining a full copy of the hard disk of WWW learns the secret value that WWW uses to authenticate to the DC. This does not give him any secret which would be sufficient to connect to the DB directly. Indeed, the DB trusts only DC. So, in order to actually connect to DB, the attacker has to pose as WWW, i.e. boot a machine on the same network, which will use its knowledge of the hard disk contents of WWW to convince DC that it is the rightful WWW, and obtain a connection ticket which will please DB. Moreover, in order to achieve that, the genuine WWW machine will have to be shut down or at least disconnected from the network, because if the DC sees two machines simultaneously, both claiming to be WWW and knowing the WWW-specific secret to that effect, then the DC is likely to go irate and cease to talk to both.
Summary: In your scenario, the theft of a copy of the complete disk of the Web server will allow rogue connections to the database only in case of an active attack in which the attacker runs a fake machine in lieu of the genuine Web server. This is equivalent to taking administrator-level control of the Web server (whether the attacker switches the hardware or not is actually irrelevant). To succeed in connecting to the database, the domain controller must still be involved.