def rm_ace(path, objectType, user, permission=None, acetype=None, propagation=None):
    r'''
    remove an ace to an object

    path:  path to the object (i.e. c:\\temp\\file, HKEY_LOCAL_MACHINE\\SOFTWARE\\KEY, etc)
    user: user to remove
    permission:  permissions for the user
    acetypes:  either allow/deny for each user/permission (ALLOW, DENY)
    propagation: how the ACE applies to children for Registry Keys and Directories(KEY, KEY&SUBKEYS, SUBKEYS)

    If any of the optional parameters are omitted (or set to None) they act as wildcards.

    CLI Example:

    .. code-block:: bash

        remove allow domain\fakeuser full control on HKLM\\SOFTWARE\\somekey propagated to this key and subkeys
            salt 'myminion' win_dacl.rm_ace 'Registry' 'HKEY_LOCAL_MACHINE\\SOFTWARE\\somekey' 'domain\fakeuser' 'FULLCONTROL' 'ALLOW' 'KEY&SUBKEYS'
    '''
    ret = {'result': None,
           'changes': {},
           'comment': ''}

    if path and user:
        dc = daclConstants()
        if propagation and objectType.upper() == "FILE":
            propagation = "FILE"
        objectTypeBit = dc.getObjectTypeBit(objectType)
        path = dc.processPath(path, objectTypeBit)

        user = user.strip()
        permission = permission.strip().upper() if permission else None
        acetype = acetype.strip().upper() if acetype else None
        propagation = propagation.strip().upper() if propagation else None

        if check_ace(path, objectType, user, permission, acetype, propagation, True)['Exists']:
            sidRet = _getUserSid(user)
            if not sidRet['result']:
                return sidRet
            permissionbit = dc.getPermissionBit(objectTypeBit, permission) if permission else None
            acetypebit = dc.getAceTypeBit(acetype) if acetype else None
            propagationbit = dc.getPropagationBit(objectTypeBit, propagation) if propagation else None
            dacl = _get_dacl(path, objectTypeBit)
            counter = 0
            acesRemoved = []
            while counter < dacl.GetAceCount():
                tAce = dacl.GetAce(counter)
                if (tAce[0][1] & win32security.INHERITED_ACE) != win32security.INHERITED_ACE:
                    if tAce[2] == sidRet['sid']:
                        if not acetypebit or tAce[0][0] == acetypebit:
                            if not propagationbit or ((tAce[0][1] & propagationbit) == propagationbit):
                                if not permissionbit or tAce[1] == permissionbit:
                                    dacl.DeleteAce(counter)
                                    counter = counter - 1
                                    acesRemoved.append(_ace_to_text(tAce, objectTypeBit))

                counter = counter + 1
            if acesRemoved:
                try:
                    win32security.SetNamedSecurityInfo(
                        path, objectTypeBit, win32security.DACL_SECURITY_INFORMATION,
                        None, None, dacl, None)
                    ret['changes']['Removed ACEs'] = acesRemoved
                    ret['result'] = True
                except Exception as e:
                    ret['result'] = False
                    ret['comment'] = 'Error removing ACE.  The error was {0}.'.format(e)
                    return ret
        else:
            ret['comment'] = 'The specified ACE was not found on the path.'
    return ret
dataset/ETHPy150Open saltstack/salt/salt/modules/win_dacl.py/rm_ace/original