Example Scenario:

We have 2 different OU (Chief & Employee) on Active Directory in our environment. User Ed Price is an OU Chief and User Annie Gers is an OU Employee. Our aim is to let just users of the Chief OU see the Active Directory objects of the Employee OU.

OU Chief



OU Employee



Lets go!!

1- Annie Gers logged in Client.



2- Before any setting, Annie Gers can find User Ed Price.
(If you need search Active Directory from Client, Use Run and enter "C:\Windows\System32\rundll32.exe" dsquery.dll,OpenQueryWindow)



3- Open Active Directory Users and Computers, cilck View, select Advances Features.



4- Right click on Chief OU and select Properties.



5- Select Security tab.



6- Click Add and add Annie Gers, than click OK.

7- Annie Gers has Read permission as default.

8- Uncheck Allow for Read and set Read to Deny, than click OK.

9- Now, Annie Gers can not find any objects in Chief OU.

In practice, Create group, than add user or users and than config this setting.