Permissions needed to restore an existing GPO