what would the correct get-acl syntax be for getting the ACL on who can manage an AD security group. I've only used get-acl for folder permissions, e.g. get-acl \\server\share - But I have read you can use it for checking permissions on AD objects to, so knowing the correct format for that would be useful to check for delegations etc.
I would suggest using dsacls.exe. It is uniquely designed for returning Directory Services ACLs.