Reporting Per ACE Per User Permission on AD Objects

I have a requirement where i have to find out for few user accounts what all permissions do they have on/in the AD forest-domain,

I intend run a check that touches ntsecuritydescriptor attribute on every object in the domain and if the username does exists on the object in the ACEs only those should be printed on the screen or exported to excel for even better sorting when checking permissions for multiple users,

I need your help on this, i want the data to 1 row should show object DN (for which ACE is interpreted) what kind of right/property/permission it is, is it inherited, is it the explicit / implicit entry, i mean after generating this output there should be no need to look at any other report using any other tool