Enzoic for AD Lite ^(TM)

The password audit provides a straightforward list of users in your domain, along with each individual's compromise status and whether any of the user accounts in your domain are sharing passwords with one another.

No license key is required for the password auditor. This is a free product.

Enzoic for Active Directory supports any 64-Bit Windows Client or Server. It can be run from any domain joined system using an account in the Administrators Group that can access the Internet.”

Enzoic for Active Directory Lite evaluates passwords based on Enzoic's database of 7+ billion compromised passwords and is updated several times each day. A database of this size could not be practically downloaded.

Enzoic rate limits the audit at 10 calls per second. Auditing a domain of 500 user takes about a minute. An audit of 10,000 users can be completed in under 20 minutes. That's checking against a database of +7B entries!

Enzoic for Active Directory Lite uses a partial hash comparison approach through Enzoic’s Password API. This allows you to check whether a given password is known to be compromised, without the exact password or hash leaving your environment. It is only necessary to supply the first 10 hex characters of a hash. A list of candidate hashes will then be returned and compared locally with the exact hash to determine if there is a match. The partial hash data is not stored by Enzoic and is actively deleted from our server memory when this process is completed.

Enzoic collects two types of vulnerable passwords: 1) Exposed refers to compromised passwords found in data breaches and 2) Weak refers to passwords found in cracking dictionaries. Neither should be considered safe for use.

The full Enzoic for Active Directory is a complete solution for keeping vulnerable passwords out of your organization and complying with current NIST guidelines. It adds a password policy within Active Directory to protect against unsafe passwords. It includes a custom password dictionary, blocks username derivatives, and checks fuzzy matches with common leetspeak substitutions. It then does automatic, continuous auditing to determine when a safe password becomes vulnerable. Remediation is also automated, including notification, password reset or disabling accounts. Learn more here https://www.enzoic.com/active-directory/.