Question:

As the Central Administration Site doesn’t publish any Client data directly, do I need to grant it’s computer account permission to the “System Management” container?

Answer:

Although Clients don’t pull any data from the Central Administration Site, Microsoft recommends you grant it permission to publish to the “System Management” container as sites don’t just publish client data to Active Directory but other data used for various non-client ConfigMgr-related tasks.

m4s0n501