The problem is that this will take a very long time to run across an entire server.

You might be better off switching on file system auditing, dump the security log and parse that.