Windows Server 2003 and Windows 2000 Server provide helpful wizards for delegating permissions to users in AD. However, no wizard exists to let you view existing delegations. To do so, you must manually view the security settings that have been applied on containers and objects.
Microsoft recently released a tool that makes it easier to view existing permissions delegations. You can download the tool–called Dsrevoke–at Microsoft Web site. Dsrevoke reports on the permissions for a domain and/or organizational units (OUs) and also lets you remove permissions.
Quelle: WindowsITPro