Need help removing a security group from ACLS

Hi TJCooper440,

# Get the security group object
$securityGroup = Get-ADGroup -Filter Name -EQ "MySecurityGroup"

# Get all objects in the OU
$ou = Get-ADOrganizationalUnit -Filter * -SearchBase "OU=MyOU,DC=example,DC=com"
$objects = Get-ADObject -Filter * -SearchBase $ou.DistinguishedName

# Filter the objects to only include security groups and user objects
$objects = $objects | Where-Object { $_.ObjectClass -eq "Group" -or $_.ObjectClass -eq "User" }

# Loop through the objects and remove the security group from the ACLs
foreach ($object in $objects) {

    # Get the ACLs for the object
    $acls = Get-Acl -Path $object.DistinguishedName

    # Check if the security group is in the ACLs
    if ($acls.Access | Where-Object { $_.IdentityReference -eq $securityGroup.Sid }) {

        # Remove the security group from the ACLs
        $acls.RemoveAccessRule($securityGroup.Sid)
    }

    # Set the ACLs back to the object
    Set-Acl -Path $object.DistinguishedName -AclObject $acls
}

This script is more robust than the previous one because it:

• Filters the objects to only include security groups and user objects. This is important because you may not want to remove the security group from the ACLs of other types of objects, such as computers or printers.
• Checks to see if the security group is in the ACLs before removing it. This prevents you from accidentally removing the security group from the ACLs of an object if it is not already there.

To use the script, replace MyOU with the name of the OU that you want to search, and replace MySecurityGroup with the name of the security group that you want to remove.