SharePoint: How to set most users to read-only with broken permissions

Imagine a MOSS 2007 farm with 1500 sites where the permissions are in bad shape with broken inheritance, permissions granted to individuals, e开发者_C百科tc..

How would someone go about making most of the farm read-only to most users without addressing each site individually?

Assumptions:

1. Two weeks left for planning
2. Four hour window to apply permissions change
3. Four weeks left until farm is completely decommissioned
4. Cannot buy third-party tools

Would site locks help on the issue?

This is what happens when a backup is underway, you can use your imagination on finding off-hours to unlock and change the site accordingly.

Presumably you have some unambiguous rules as to who should be in the read-only group and who should not. With two weeks for "planning" depending on the complexity of the rules you may be able to write a quick command line utility to traverse the sites and apply the rules. For example, this could programtically adjust group membership on a per site basis. Whether it would complete within the four hour window could be estimated on a test farm beforehand. Good luck!