无法使用Get-ACL/Set-ACL来执行此操作，但是可以编辑defaultSecurityDescriptor属性，如下所示：

$adSchema = (Get-ADRootDSE).schemaNamingContext
$computerObject = Get-ADObject -SearchBase $adSchema -Filter "Name -eq 'Computer'" -Properties defaultSecurityDescriptor
$computerDefaultSecurityDescriptor = New-Object -TypeName System.Security.AccessControl.CommonSecurityDescriptor -ArgumentList @($false, $false, $computerObject.defaultSecurityDescriptor)

# make modifications to $computerDefaultSecurityDescriptor.DiscretionaryACL
# e.g. 
# $computerDefaultSecurityDescriptor.DiscretionaryAcl | where SecurityIdentifier -eq "S-1-3-0" | % $computerDefaultSecurityDescriptor.DiscretionaryAcl.RemoveAce($_)

$newSDDL = $computerDefaultSecurityDescriptor.GetSddlForm([System.Security.AccessControl.AccessControlSections]::All);'
Set-ADObject $ComputerObject -replace @{defaultSecurityDescriptor = $newSDDL}