Hide Active Directory folder

UserNative Intune settingAD_HideDirectoryFolder

Supported on Windows 2000 only

22H2 · 1.0

What it does

Hides the Active Directory folder in Network Locations. The Active Directory folder displays Active Directory objects in a browse window. If you enable this setting, the Active Directory folder does not appear in the Network Locations folder. If you disable this setting or do not configure it, the Active Directory folder appears in the Network Locations folder. This setting is designed to let users search Active Directory but not tempt them to casually browse Active Directory.

What it writes

Hive: HKEY_CURRENT_USER
Registry key: Software\Policies\Microsoft\Windows\Directory UI
Value name: HideDirectoryFolder
When enabled: DWORD 1
When disabled: value removed

Why it needs changes for Intune

Policy references a Windows supportedOn definition.
ADMX-INTUNE-WINDOWS-SUPPORTEDON-REFERENCE

In Intune

Native Intune setting: Yes — Policy CSP

./User/Vendor/MSFT/Policy/Config/ADMX_Desktop/AD_HideDirectoryFolderADMX_Desktop on Microsoft LearnADMX-backed: Windows ships this template, so it is set with the template's own values, without an import.Windows builds listed: 10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202.

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Configure and deploy

Choose a state; the output below is generated from the template for exactly that.

Enabled · User · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Directory UI]
"HideDirectoryFolder"=dword:00000001

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Hide Active Directory folder
# Name: AD_HideDirectoryFolder
# Scope: User
# State: Enabled
# Source: Desktop.admx

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Directory UI' -Name 'HideDirectoryFolder' -PropertyType 'DWord' -Value 1

These deployment candidates come from the ADMX template; they are separate from the native CSP mapping above.

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.

ADMX profile candidate (OMA-URI)

./User/Vendor/MSFT/Policy/Config/ADMX_Desktop/AD_HideDirectoryFolder

ADMX SyncML candidate

<SyncML xmlns="SYNCML:SYNCML1.2">
  <SyncBody>
    <Replace>
      <CmdID>1</CmdID>
      <Item>
        <Meta>
          <Format>chr</Format>
          <Type>text/plain</Type>
        </Meta>
        <Target>
          <LocURI>./User/Vendor/MSFT/Policy/Config/ADMX_Desktop/AD_HideDirectoryFolder</LocURI>
        </Target>
        <Data>&lt;enabled/&gt;</Data>
      </Item>
    </Replace>
    <Final/>
  </SyncBody>
</SyncML>

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Hide Active Directory folder
# Name: AD_HideDirectoryFolder
# Scope: User
# State: Enabled
# Source: Desktop.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Directory UI' -Name 'HideDirectoryFolder' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Directory UI\HideDirectoryFolder') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Hide Active Directory folder
# Name: AD_HideDirectoryFolder
# Scope: User
# State: Enabled
# Source: Desktop.admx

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Directory UI' -Name 'HideDirectoryFolder' -PropertyType 'DWord' -Value 1

History 2 retained releases

22H2 · 1.015 Jul 2024
- Translations changed; choose a language above to compare its wording.
1607 · 2.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

Template

Internal name: AD_HideDirectoryFolder
Namespace: Microsoft.Policies.WindowsDesktop
Template file: Desktop.admx
Release: Windows 10 22H2 · 1.0 · file set bc15f6a5271783ee…

Definition, editor controls and support

Definition

<policy class="User" displayName="$(string.AD_HideDirectoryFolder)" explainText="$(string.AD_HideDirectoryFolder_Help)" key="Software\Policies\Microsoft\Windows\Directory UI" name="AD_HideDirectoryFolder" valueName="HideDirectoryFolder" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.WindowsDesktop:ActiveDirectory" />
      <supportedOn ref="Microsoft.Policies.Windows:SUPPORTED_Win2kOnly" />
    </policy>

Editor controls

Supported platforms and category

Microsoft.Policies.Windows:category:Desktop
<category displayName="$(string.Desktop)" explainText="$(string.Desktop_Help)" name="Desktop" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Windows:definition:SUPPORTED_Win2kOnly
<definition displayName="$(string.SUPPORTED_Win2kOnly)" name="SUPPORTED_Win2kOnly" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <reference ref="Microsoft.Policies.Products:MicrosoftWindows2000" />
        </or>
      </definition>
Microsoft.Policies.Windows:unresolved:Microsoft.Policies.Products:MicrosoftWindows2000
<unresolved reference="Microsoft.Policies.Products:MicrosoftWindows2000" />
Microsoft.Policies.WindowsDesktop:category:ActiveDirectory
<category displayName="$(string.ActiveDirectory)" name="ActiveDirectory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:Desktop" />
    </category>
Microsoft.Policies.Windows:category:Desktop
<category displayName="$(string.Desktop)" explainText="$(string.Desktop_Help)" name="Desktop" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:Desktop">Desktop</string><string id="Microsoft.Policies.Windows:Desktop_Help">Contains settings to manage behavior of the user's desktop, as well as which default icons are displayed on that desktop.</string></strings>
Microsoft.Policies.Windows:definition:SUPPORTED_Win2kOnly
<definition displayName="$(string.SUPPORTED_Win2kOnly)" name="SUPPORTED_Win2kOnly" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <reference ref="Microsoft.Policies.Products:MicrosoftWindows2000" />
        </or>
      </definition>
<strings><string id="Microsoft.Policies.Windows:SUPPORTED_Win2kOnly">Windows 2000 only</string></strings>
Microsoft.Policies.WindowsDesktop:category:ActiveDirectory
<category displayName="$(string.ActiveDirectory)" name="ActiveDirectory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:Desktop" />
    </category>
<strings><string id="Microsoft.Policies.WindowsDesktop:ActiveDirectory">Active Directory</string></strings>