Firstly be CAREFULL!! Make sure you test the following scripts against your environment carefully before you try and run it whole hog!!

Powershell is the answer.
First Find the Orphaned SIDS:

$SearchFolder = “W:”

Get-ChildItem $searchfolder -Recurse | foreach {
if ($_.PSIsContainer -eq $True)
{
$folderacl = $_.getaccesscontrol()
$folder=$_
$Orphans = @()
$folderacl.Access | foreach {
if (-not $_.isinherited)
{
if ($_.IdentityReference -match “S-1-5-21-”)
{
$Orphans += $_
}
}
}
foreach ($Orphan in $Orphans)
{
$folder.fullname + ” ” + $Orphan.IdentityReference >> OUtput.txt
}
}
}

The code to remove the orphaned SIDS goes under “foreach ($Orphan in $Orphans).” I created a second script identical to the first one and simply replaced the section as follows:

foreach ($Orphan in $Orphans)
{
$folder.fullname + ” ” + $Orphan.IdentityReference
$ACLtoRemove = $Orphan
$folder.fullname + ” ” + $ACLtoRemove.IdentityReference

$colRights = $ACLtoRemove.FileSystemRights
$InheritanceFlag = $ACLtoRemove.InheritanceFlags
$PropagationFlag = $ACLtoRemove.PropagationFlags

$objType = $ACLtoRemove.AccessControlType

$objUser =$ACLtoRemove.IdentityReference

$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
($objUser, $colRights, $InheritanceFlag, $PropagationFlag, $objType)

$objACL = Get-Acl $folder.fullname
$objACL.RemoveAccessRule($objACE)

Set-Acl $folder.fullname $objACL
}