The engagement separates preparation of breach-password data from comparison against Active Directory. The comparison plan requires an Internet-disconnected assessment computer with controlled AD connectivity and an authorized account with appropriate AD permissions.
The tool returns account identifiers for follow-up and records execution in the Windows Event Log. Reported results do not include password values. We agree how account lists and audit records are accessed, retained, and handled before execution.
A match indicates that an account's password appears in the comparison dataset. It does not, by itself, establish that the corporate account was breached or that an employee personally reused that password.
We agree remediation responsibilities and any recheck. This assessment complements screening of new or changed passwords, stronger authentication, and access controls.