restore ad objects

Question

Hello,

How do I give delegation for domain user to restore objects from ad?

I used the following command:

dsacls dc=<your domain>,dc=<com> /g "restore_objects:ca;Reanimate Tombstones"

dsacls "cn=deleted objects,dc=<your domain>,dc=<com>" /takeownership

dsacls "cn=deleted objects,dc=<your domain>,dc=<com>" /g "restore_objects:LCRP"

https://nettools.net/how-to-delegate-object-restoration-rights/

domain admins are able to restore object

domain users in the group: restore_objects are able to restore object from recycle bin only if the object is in ou that Protected from accidental deletion is unchecked, they receive error "access is denied".

Thanks