https://rakhesh.com/powershell/using-get-acl-to-filter-ad-objects-without-certain-group-acls/