Compliance check use of Roles

I am being asked to produce a script that will check that no idividual users have been assigned permissions in vCenter, only AD groups should be assigned perms. Has anyone done this? Do I need to recursively read each folder to check or can I easily see for each role what and where has been applied?

Any help would be appreciated

Thanks