How can I let users search, but not browse, Active Directory (AD)?

Open Group Policy with the Group Policy Editor (GPE).

Navigate to User Configurations, Administrative Templates, Desktop, AD.

Double-click "Hide Active Directory folder."

Select the Policy tab.

Click Enabled, and click OK.

Close the policy.

Start the registry editor (e.g., regedit.exe).

Navigate to HKEY_CURRENT_USERSOFTWAREPoliciesMicrosoft.

If the Windows key doesn't exist, click Edit, New, Key to create the key.

Look for "Directory UI" under the Windows key, and if it doesn't exist, click Edit, New, Key to create the key.

From the Edit menu, select New-DWORD Value.

Enter a name of HideDirectoryFolder, and press Enter.

Double-click the new value, set it to 1, and click OK.

Close the registry editor.