The syntax in the final Step 5 above is incorrect. It should actually be
Remove-ADPermission "dc=<Domain>,dc=<tld>" -user "<RootDomain>\Exchange Servers" -AccessRights WriteDACL -InheritedObjectType Group
For example, if the domain is microsoft.com the first parameter should be "dc=microsoft,dc=com" NOT simply "dc=microsoft.com" as the text implies.