Now and then when publishing the topology, I’ve gotten some warnings that just states one or more of these:

Warning: Ace DOMAIN\RTCUniversalGlobalReadOnlyGroup; Allow; ReadProperty; None; None

and also later in the log

Warning: One or more group access control entries (ACEs) are not ready.

This means that not all ACEs are ready after the forest prep, for whatever reason. Just run a

Enable-CsAdForest

which should reset the permissions, and you should be fine.

http://technet.microsoft.com/en-us/library/gg425713(v=ocs.15).aspx