Following some security breach in my office and stealing data from the company, my manager gave me the task of finding all the folders on the file server which users have read access to and they didn't use that permission in the last 3 months. Is that possible without a third party software?
You could setup auditing for the paths which should give you information (as logged events) who read folder content/when etc. which then you would somehow need to process (scripts would be a minimum) and then you would need to give it 3 months to actually build up the information.
If your company is actually putting this on the top of the priority list then I would suggest:
Seems draconic but if relaxed/unmaintained permissions have been at least a part of the reason why data theft in your company happened then I think it is something worth considering (highly depends on the size of your company).