Now and then when publishing the topology, I’ve gotten some warnings that just states one or more of these:
Warning: Ace DOMAIN\RTCUniversalGlobalReadOnlyGroup; Allow; ReadProperty; None; None and also later in the log
Warning: One or more group access control entries (ACEs) are not ready.
This means that not all ACEs are ready after the forest prep, for whatever reason. Just run a
Enable-CsAdForest
This should reset the permissions, and you should be fine.