Requires Python 3.3.
(This more of an ad hoc script, slightly generalized, but it's hardly best piece of code. Also it's not very tested :-) .)
This can be used either as a library or as a GUI application.
To get a log file run
icacls folder-name /T > logfile.txton the command line.
It is expected that root folder contains no "\" so folder name cannot be anything like "a\b", "c:\x" or "..\abc".
It generates a dictionary (or shows it as a tree if used as GUI application) of path => user+rights mapping, but only those, where the users and/or rights differ from parent path. E.g.
folder ... user_a (R), user_b(F)
folder/subfolder1/subsubfolder ... user_a (R), user_b(F)
folder/subfolder2 ... user_a (F), user_b(F)
folder/subfolder1/subsubfolder will not be shown as there are no new or missing users from parent and all the users has same rights as in parent. The inheritance flags are ignored in the comparison, e.g. (OI)(F) == (I)(F).
Users CREATOR OWNER NT AUTHORITY\SYSTEM BUILTIN\Administrators are ignored (except for the limitation below) and not shown.
Path cannot have only one user. Because both users and paths can contain spaces it would be impossible to distinguish them. Normally this should not be problem as there are always users like NT AUTHORITY\SYSTEM or BUILTIN\Administrators.
Home/End keys do nothing, PgUp/PgDown works badly etc. Yup, welcome to the world of Tkinter.