SetACL fully supports Windows NT and later permissions as well as inheritance and inheritance blocking. SetACL lets you perform any of its operations on just the specified object or on the specified object and all child objects.

First, I show you a SetACL command that will search the ACL for each file and folder on a hard disk for access control entries (ACEs) for users or groups from the old domain. For each such occurrence, SetACL will duplicate the ACE but substitute the new domain name for the old domain name. The command

SetACL.exe -on \\server1\share1
  -ot file -actn domain
  -rec cont_obj
  -dom "n1:OldDomain;
    n2:MainDomain;da:cpydom;
    w:dacl"

processes each file and subfolder in \\server1\share1. (Although this command appears on several lines here, you must enter it on one line in the command-shell window, making sure there are no spaces after the semicolons.) When SetACL encounters an ACE for a user or group in OldDomain, it looks up the same username or group name in MainDomain and finds the SID for that user or group. Then, SetACL uses the SID to create a new ACE with the same permissions in MainDomain. After you execute this command, user Fred will have the same access whether he logs on as olddomain\fred or maindomain\fred. After you complete the migration, you can use the command

SetACL.exe -on \\server1\share1
  -ot file -actn domain
  -rec cont_obj -dom
  "n1:OldDomain;da:remdom;w:dacl"

to delete all the old ACEs.