The Quest cmdlets are pretty good at managing permissions. For example if you want to assign full control to the "ClusterAdmin" group on all computer objects in the "OU" OU, you can do:

add-qadpermission "$($env:USERDNSDOMAIN)/OU" -account "$($env:USERDOMAIN)\ClusterAdmin" -Rights 'GenericAll' -ApplyTo 'ChildObjects' -applyToType computer