I'm setting up RBAC and need to hide an OU and it's contents...simple eh?
I've done the usual stuff that you need to do, checked the access and the users (as designed) cannot see the browse the OU. Perfect you'd think...however I've noticed a quirk and was wondering whether I've done something wrong or, whether it's a 'feature' of Active Directory.
When you do a search in ADUC or any other 3rd party utilities etc. the results still return the users from the 'hidden' OU....this wouldn't normally stress me too much as they have no permissions and cannot amend the user objects however, the client has expressed a desire to have none of the hidden users shown in the search results.
I've looked through all I can find (even the dSHeuristics attribute) but it searches are still returning the 'hidden' users....have I done something wrong? Is there a way to do this in AD (i.e. can you hide the OU and prevent the 'hidden' users from being returned in searches)?
Answers on a postcard to....
FMcFF
