Yeah, it's possible... but not in a way that makes it worth doing, in my opinion.
You can, on any Active Directory object, granularly control who can read which attributes. On the person whose phone number you want to hide, you would need to:
- Remove the default
Allow
permissions that Authenticated Users
have to read the attribute in question.
- By default,
Authenticated Users
can Read all properties
of other Active Directory users, so you need to go to the user whose phone number you want to hide and remove those default Read all properties
permissions.
Replace those removed permissions with read permissions for the attributes you want "everyone" to be able see (which is probably/generally everything except the phone number).
Manually allow the desired group or user(s) permission to view the attribute where the phone number in question is stored. The "primary" attribute is Telephone-Number
, but there are a bunch of other ones too... off the top of my head, Mobile Number
, Home Phone
, Home Phone Number (Others)
, IP Phone Number
, IP Phone Number (Others)
, and Phone Number (Others)
. Screenshot from ADSI edit:
Having said that, it's much easier, and much better to just fire any moron who demonstrates that they can't be trusted with someone's telephone number. This approach also has the advantage of not being counter to stated Microsoft best practices.