https://www.petervanderwoude.nl/post/weird-but-true-permissions-required-to-use-resultant-client-settings-in-configmgr-2012/