How can I enable the List Object security option in Active Directory (AD)?

A. By default, users can view the content of organizational units (OUs). You can prevent users from viewing OU content by removing the List Contents right for that OU, or you can use the List Object permission to explicitly select which objects in an OU are viewable by particular users or groups.

To enable the List Object option, perform these steps on a domain controller (DC) or on a machine that has adsiedit.msc installed. (ADSI Edit is part of the Windows 2000 or later support tools.)

Now when you select an object's advanced security properties, a new List Object property is displayed, as the figure at figure shows.

You need to ensure that you set the List Object right not only on the objects you want to be visible but also on the OU containing the objects. Remember to remove the List Contents permission from the container for users whom you don't want to view the entire contents. For example, by default the Authenticated Users group has List Contents permission, so you'd need to remove that right to allow the more granular List Object capability.

Be careful when using the List Object functionality because it makes DCs perform extra work. The DC must check every object in a container to determine whether the object should be visible instead of merely checking the container for a general list or "not list" option.