Retrieve-OnlyGroupsFromACL.ps1

$NetBiosName = "DOMAIN"

(Get-Acl c:\temp).Access | 
  Where-Object {
    ($_.IdentityReference -split '\\') -eq $NetBiosName
  } |
  ForEach-Object { 
    $SAMAccountName = ($_.IdentityReference -split '\\')[1]
    $Class =( Get-ADObject -Filter {Samaccountname -eq $SAMAccountName}).objectclass
    switch ($Class) {
      "user" { "Object is a user" }
      "group" { "Object is a group"}
      Default { "Object is building a mystery"}
    }
  }