If you're the administrator and you have permission to use it on your own network, they're not illegal.
If you already have the password you could easily estimate a rough figure of how secure it is. If it's a Windows domain, you can set the policy to lock out the account after X number of incorrect tries and specify how long to lock out the account; this makes brute forcing extremely infeasible. Second, if the password isn't based on a word (or words) in the dictionary, you are ahead of the game. Combination of uppercase, lowercase, numbers, maybe even symbols will keep it from being easily cracked.
Seeing how long the password holds out isn't a good estimate, since you don't know if a potential attacker has distributed computing power at their disposal or what kind of horsepower they'd have anyway. And if you already have a non-dictionary based password that is regularly changed, combined with lockout policies, then your bigger worry moves to people shoulder-surfing or social engineering your system or using keystroke loggers or sniffers, all of which renders the password @##$%@FFFES#@12 about as secure as a house walled with cellophane anyway.