Over time, Active Directory delegations tend to accumulate and drift from the standards in the enterprise. Removing the delegations for a user or group can be slow, especially if you do it manually. Microsoft has a good article about this process, but none of the methods I found did what I needed. I wanted a script which could look at all or selected OUs in AD for a delegation, and then delete them all.
Remove-DelegatedOUPermissions.ps1 is an advanced function which can be used to report and remove assigned delegated permissions from OU objects and containers. You can choose the domain and searchbase, and you can search for full name or partial matches. For example, if you wanted to report on or delete the delegations for Site1PWAdmins and Site2PWAdmins, you could simply specify “PWAdmins”. The search is case-insensitive, and you can search for more than one string by separating your search terms with a comma.
This function always creates a log file. The default name is derived from the domain name, and the default location is the desktop. The function requires the ActiveDirectory module, but unlike Set-ACL, it can be used to write permissions in another domain. It supports WhatIf, and a confirmation is required before you commit changes. Because it is an advanced function, you can use Get-Help for details about use.