Over at http://www.sysinternals.com, you can find the AccessEnum utility. It is a simple tool with which you enumerate the access rights of a folder or registry key. You can save the results to a textfile.

The nice feature is that you can compare the saved results to another scan. I used this feature to detect the changes made by the adprep /gprep procedure. After the compare, you can clearly see that the procedure grants rights on all policy folders to NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS.