Isso faria o trabalho? O SubInACL da Microsoft. É linha de comando, mas é grátis.
SubInACL is a command-line tool that enables administrators to obtain security information about files, registry keys, and services, and transfer this information from user to user, from local or global group to group, and from domain to domain.