Once a user or group is delegated access, it's necessary to remove the access manually. Microsoft has released a tool that will undo the process that delegation goes through. DSRevoke.exe will traverse all the ACL's in the domain and remove access for the user(s) or group(s) specified.
http://www.microsoft.com/downloads/details.aspx?FamilyID=77744807-c403-4bda-b0e4-c2093b8d6383&displaylang=en
