This is a fairly simple script and since we are in the process of migrating, I will not make it fancy, I only need it once and it doesn't exists.
Get your log (with extention .log) from GWCheck or from a scheduled event on the POA('s). Do an Analy/Fix on Contents and collect statistics on the user databases alone. On the logging tab, tick Verbose logging.
Be aware that the logs created this way are BIG. Place all logs in one folder and run the script in this folder. Output is a CSV file with PO/username of who has given rights, username of who was given rights to and what rights (in error code and text).