Not as easy as it sounds. You have to look specifically for inheritable ACEs, and that can be a lot of work. Look at Win32::Security.