Powershell ACL设置ACL条目以允许或拒绝类型

Ok, so I'm having trouble with figuring out how to change an ACL for a folder using powershell. I have NAS folders that I would like my script to change the type settings on from 'Allow' to 'Deny' without changing the rules or the principal, but only for specific groups. The reason is that the folder belongs to an individual, and when that individuals AD account expires I want two of the groups that had access to it to no longer have access. Once the individual's AD account is reactivated, the script will "flip" the type back from "Deny" to "Allow". I have figured out how to extract the info, but having a hard time setting it:Ok, so I'm having trouble with figuring out how