Windows Server 2016 – Access Denied When Adding or Changing a GPO

I have inherited a network whose GPOs are damaged, the SYSVOL folder shows signs of tampering with the NTFS permissions and folder structure manually, and I am unable to add/edit any GPOs, I receive an "Access Denied" error and the only entry in eventvwr I can find looks like an app crash for the mmc plugin. From timestamps it is clear this hasn't worked for 4+years.

• I have performed a D2 and D4 restore separately, this did not resolve the issue. auth restore img
• I have confirmed delegation permissions on the domain were modified, I reset them to default. Domain permission delegation img
• Group Policy Object permissions are still modified from original, couldn't figure out how to reset these to default: Group Policy Object Permissions img
• There are no existing GPOs I have to worry about.
• There are 3 Server 2016 DCs.
• I attempted to add NTFS permissions to C:\Windows\Sysvol and sub folders individually to give my domain admin account full control. Still no change.
• gpupdate seems to work fine, I just can't add or edit policies from any DC

At this time I cannot create or edit GPOs, but client machines gpupdate successfully. What else can I do to be able to edit GPOs again?