The security for user account objects in an OU may drift over time. User accounts moved within the domain will retain delegations previously made, and user accounts created after schema extensions won’t have the same security as user accounts created earlier in time. Reset-UserAccountACLs.ps1 resets the security (ACLs) for user accounts within an OU to the defaults for a new user in that OU. It works by creating a temporary user object, copying the permissions, and applying those permissions to existing users withing the OU.
You choose the domain and OU from a GUI. I use a RemoteAD drive to get and set ACLs in remote domains. Test mode will create a report with no changes made.