TACH!
Meintest du vielleicht ACLDIAG? Ist bei den Support-Tools mit dabei. (support.cab)
This command-line tool detects and reports discrepancies in the access control lists (ACLs) of objects in Active Directory. It can also reapply a security delegation template to an ACL, eliminating special permissions and restoring incomplete delegations.
With AclDiag, you can:
Display the access control entries (ACEs) in the ACL, and inheritance and audit settings.
Display the effective permissions of users and groups to an Active Directory object.
Compare the ACL for an object in Active Directory to the default permissions defined in the schema.
Compare the ACL of an Active Directory object to a delegation template.
Reapply the delegation template to the ACL of an Active Directory object.