SharePoint: How to set most users to read-only with broken permissions

Question

Imagine a MOSS 2007 farm with 1500 sites where the permissions are in bad shape with broken inheritance, permissions granted to individuals, etc..

How would someone go about making most of the farm read-only to most users without addressing each site individually?

Assumptions:

1. Two weeks left for planning
2. Four hour window to apply permissions change
3. Four weeks left until farm is completely decommissioned
4. Cannot buy third-party tools

Answer 1

Would site locks help on the issue?

This is what happens when a backup is underway, you can use your imagination on finding off-hours to unlock and change the site accordingly.

Answer 2

Presumably you have some unambiguous rules as to who should be in the read-only group and who should not. With two weeks for "planning" depending on the complexity of the rules you may be able to write a quick command line utility to traverse the sites and apply the rules. For example, this could programtically adjust group membership on a per site basis. Whether it would complete within the four hour window could be estimated on a test farm beforehand. Good luck!