There is a tool called EXPORTER - a freeware command-line tool from the folks that make the Hyena(sic?) management tool.
Just configure the ini file to only dump what you want, then run it, specifying the domain name you want to search. It will find and query all systems on the domain, writing to a tab-separated file.
I haven't used that specific function in some time, but I believe that it will also return the permissions (in a different file). I used this about 2 years ago to help a client lock down their network prior to going to A-D.
It would be pretty easy for Kix to parse the files, and then make changes using something like CACLS.
Glenn
_________________________
Actually I
am a Rocket Scientist!
