OK guys- here's what happened.
A Group Policy was applied to out Domain (400+ Machines) that re-permissioned the entire subordinate registry keys etc. on HKLM\System & HKLM\Software. We are scrambling to first find the correct permissions of keys identified as wrong and then push these out in GP to repair this oversight. I'm looking for a way to take an ACL 'snapshot' of a known good registry, edit that, and apply to all affected machines. Looking to do this for Windows XP and Windows 7 workstations. I have a ticket open with Microsoft and they are telling me I need to manually 'find' the incorrect keys and script the fixes. While pushing out the fixes are not the issue- finding the wrong keys from problems known and unknown will be tremendous.
Anyone have any Ideas?