To change the default ACL for groups in a specific domain, you must edit the domain LDAP entry. Change the value of the groupdefaultacl property in the icsExtendedDomainPrefs attribute.