How to grant permissions via aduc graphical console ?

Question

Hello. I am a student of AGPM.

I have granted the minimum rights as per the documentation. Separate user account, local admin rights and backup operators, group policy creator owners. And full folder permissions.

When I want to take control of the policy, I get an error:

Control GPO: Default Domain Controllers Policy...Failed

[GPMC Error] Could not take ownership of the production GPO. Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

---

1 actions failed.

If I run the service from a domain administrator account, everything is fine.

I found this article: https://archive.z-nerd.com/blog/2016/12/24-gpos-screw-it-well-do-it-live-iv/

And a script to solve the problem.

https://github.com/theznerd/AGPMScripts/blob/master/Set-GPOFullControl.ps1

• Can you explain me in detail what and how this script modifies in Active Directory ?
• Can you show me if I can do it through the graphical console ?
• Can you explain why I am getting this error ? How does it work ? Which access groups manage this ? Maybe I can delegate group policy management to my account that I run AGPM with ?
• I want to give minimum permissions but I am afraid to use a script, also I don't understand how to document this as I don't understand what changes are made to Active Directory and what processes are responsible for this.