Clearing `location path=` handler settings for sites in applicationHost.config

This one is giving me a headache for last few days...

Over the years, as we moved websites around (for example from IIS 6.0 to 7.5 or 8.0/8.5), some websites got their configuration applied to the applicationHost.config file, in stead of a website web.config. This may also be due to faulty provisioning and scripting on our side.

I can't seem to find a way to clear a handlers section of such a website configuration in applicationHost.config. Example, in my applicationHost.config I have:

<location path="example.com"><system.webServer><handlers accessPolicy="Read, Script"><clear /><add name="PHP4" path="*.php4" verb="*" modules="FastCgiModule" scriptProcessor="c:\php5\php-cgi.exe" resourceType="File" /><add name="PHP3" path="*.php3" verb="*" modules="FastCgiModule" scriptProcessor="c:\php5\php-cgi.exe" resourceType="File" /><add name="PHP" path="*.php" verb="*" modules="FastCgiModule" scriptProcessor="c:\php5\php-cgi.exe" resourceType="File" /><add name="ScriptResource.axd" path="ScriptResource.axd" verb="*" type="System.Web.Handlers.ScriptResourceHandler" />
	  [...]</handlers>

This can be cleared with appcmd: `

appcmd clear config example.com -section:handlers

but not for an unknown number of websites (and unknown websites). I can't seem to pull them out automatically (scripted). Other configuration settings for this website in applicationHost.config may be left behind, no problem there.

Who can help?

Appcmd has my preference, since PowerShell eats a lot of memory looping through the applicationHost.config / sites.

Edit: the best I can come up with is to simply delete all website handlers in applicationHost.config:

get-website | foreach {$website = $_.name&appcmd clear config $website -section:handlers /commit:apphost
}