This function returns the user name and sid of people who have permissions to a share. It works locally or remotely. When working remotely, it will accept alternate credentials. This function is an advanced function, and therefore it accepts pipelined input. I use splatting to determine what values get passed to the Get-WmiObject cmdlet. Once loaded, either through dot sourcing, or simply running once inside the ISE, you can pipeline an array of share names to the function, and it will return users, domain, and SID of who has permissions to the share. One easy way to obtain the shares, is to use WMI. The following code creates an array of shares from a remote server (I choose user defined file shares).

$shares = @()
gwmi win32_share -cn hyperv1 -cred (Get-Credential) -Filter "type=0" |
% { $shares += $ }

This script is discussed on the Hey Scripting Guy Blog on November 27, 2011.

# ----------------------------------------------------------------------------- 
# Script: Get-ShareUsers.ps1 
# Author: ed wilson, msft 
# Date: 11/21/2011 15:14:55 
# Keywords: Storage, Shared Folders and Mapped Drives, Security 
# comments: 
# WES-11-27-11 
# ----------------------------------------------------------------------------- 
Function Get-ShareUsers 
    This returns user name and sid of people with permission to a share 
    This function returns user name and sid of users with permission to 
    a share. It works locally or remotely, and accepts alternate credentials 
    for remote connections 
    "data" | Get-ShareUsers 
    Returns information about who has access to the data share on the 
    local computer 
    "data","shared" | Get-ShareUsers -cn hyperv1 -credential administrator 
    Prompts for credentials of administrator on a remote server named hyperv1 
    and returns users with permissions on the shared and the data shares 
    $shares = @() 
    gwmi win32_share -cn hyperv1 -cred (Get-Credential) -Filter "type=0" |  
    % { $shares += $ } 
    $shares | Get-ShareUsers -cn hyperv1 -cred administrator 
    This example queries WMI to create an array of share names on a remote server 
    It then pipelines that array to the Get-ShareUsers function where it connects 
    to a remote server named hyperv1 using administrator credentials 
   .Parameter Credential 
    The user name to use for Get-Credential when connecting remotely 
   .Parameter Share 
    The name of the share to return information about 
    .Parameter cn 
     The name of the remote computer. 
    NAME:  Get-ShareUsers 
    AUTHOR: ed wilson, msft 
    LASTEDIT: 11/22/2011 18:04:10 
    KEYWORDS: Windows PowerShell, Scripting Guy!, Weekend Scripter, , storage,  
    shared folders and mapped drives, security 
    HSG: WES-11-27-11 
 #Requires -Version 2.0 
 Param (  
  [Parameter(Mandatory = $true,Position = 0,valueFromPipeline=$true)] 
  [string]$cn = $env:COMPUTERNAME 
  $remoteParam = @{} 
  if($credential) { $remoteParam.add( "Credential", (Get-Credential $credential)) 
                   $remoteParam.Add( "Computername"$cn) } 
   $query = "Associators of {win32_LogicalShareSecuritySetting='$share'}  
   Where resultclass = win32_sid" 
   Get-WmiObject -query $query @RemoteParam |  
   Select-Object -Property @{LABEL="User";EXPRESSION= 
    {"{0}\{1}" -$_.ReferencedDomainName, $_.AccountName}}, SID  
} #end function Get-ShareUsers