Example removal of an ACE via PowerShell ADSI

removeace.ps1

# get SID for "Everyone" principal
$sid = [Security.Principal.securityidentifier]::new([System.Security.Principal.WellKnownSidType]::WorldSid, $null)
$everyone = $sid.Translate([security.principal.ntaccount])

# change user password permissions
$adRight=[DirectoryServices.ActiveDirectoryRights]"ExtendedRight"
$pguid = new-object GUID "ab721a53-1e2f-11d0-9819-00aa0040529b"  # refer to https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb

# craft an ACE that grants "Everyone" "Allow" for changing user password 
$accessRuleArgs = $everyone,$adRight,"Allow",$pguid,"None"
$ace = new-object DirectoryServices.ActiveDirectoryAccessRule $accessRuleArgs

# for each user, remove the ACE from its DACL
$users = get-aduser -filter *
foreach($user in $users){
    $path = "LDAP://" + $user.DistinguishedName
    $obj = [adsi]$path
    $obj.psbase.ObjectSecurity.RemoveAccessRule($ace)
    $obj.psbase.CommitChanges()
}

removeace2.ps1

# the easy way

$users = get-aduser -filter *
foreach($user in $users){
    $path = "LDAP://" + $user.DistinguishedName
    $obj = [adsi]$path
    $ace = $user.psbase.ObjectSecurity.Access | where IdentityReference -eq "Everyone" | where ObjectType -eq ab721a55-1e2f-11d0-9819-00aa0040529b | where ...  # whatever conditions you need
    $obj.psbase.ObjectSecurity.RemoveAccessRule($ace)
    $obj.psbase.CommitChanges()
}