You can run ADFind from any box as long as it can reach a domain controller. Obviously you would replace domaincontroller01 with the name or IP of a domain controller and change the "CN=Users,DC=domain,DC=com" to reflect the path to the users in question.
There is no mechanism in Windows to create a user with a specified SID. Indeed, the first portion of the SID is machine or domain-specific anyway-- only the last portion, the relative ID (RID) varies per user on the machine / domain. If, somehow, these two machines were disk-clones of each other you'd have some shot at doing what you want, but even then it would be a hack.
Your best bet is to write a script using the built-in "calcs" command (or the third-party setacl utility) to apply the permission you want and execute that on the web server each time you need to have those permissions applied.
You might be able to get away with a hack by "backing up" the security using the backup functionality of setacl, editing the resulting "backup" file to include the right SID for the destination machine, and then restoring the backup file to the destination machine.
I'd just write a script to set the permissions and store it in your source code control repository along with the rest of the site. It's really part of the configuration of the site and needs to be maintained.
Best Answer
ADFind can do this. The list of options is here. For example, you might do something like this to export a list of users with their SID:
You can run ADFind from any box as long as it can reach a domain controller. Obviously you would replace domaincontroller01 with the name or IP of a domain controller and change the "CN=Users,DC=domain,DC=com" to reflect the path to the users in question.