The following lines should list all permissions that are not assigned to an AD group.
It uses a cmdlet from the Quest AD Snapin.
Get-VIPermission|%{ if(!(Get-QADObject$_.Principal) -or!$_.IsGroup){ $_|Select@{N="Entity";E={$_.Entity.Name}},Principal,Role
} }