In order to be able to perform the undelete operation as an originating
update, the requester must have the following permissions. No
permissions are required for replicated updates.
The Reanimate-Tombstones control access right
on the NC root of the NC
where the operation is being performed.
All the permissions required to rename an object
CREATE_CHILD on the new parent container for the objectClass
of the object being undeleted.
Note Unlike with the Modify DN operation,
the Delete/DeleteChild permission is not required.