Watcher service is getting Access is Denied events (4237116)

Confirm the account that the Watcher Service runs as (should be the same as the GPOAdmin service) has been granted the "Replicating directory changes" permission on the Default Naming Context (DC=domain,DC=com) and the Configuration Context (CN=Configuration,DC=domain,DC=com) for this object and all descendant objects.

If the account has been granted the Replicating directory changes permission in the domain, try giving the account Full Control at the domain level in GPMC:

1. Open GPMC
2. Expand Forest | Domains
3. Select the Domain to highlight it
4. In the Window pane on the right select the Delegation tab
5. Click Advanced
6. If the service account is not already listed, click Add and select the service account
7. Select the service account from the list and check Full Control
8. Click OK
9. Restart the Watcher Service