Enzoic Console Light runs on a local domain joined computer, to check AD for weak passwords, recycled passwords (eg. for domain user/domain admin pairs on the IT team) and passwords included in disclosed breaches.
The first 10 characters of the password hash is compared with the online database. Any matches are downloaded for local comparison, meaning the full password hash does not leave the network.
The free version will give a simple report when run, with paid versions running resident for continual checking.
Nice handy tool!
Adventures in a Binary Landscape 