Account Privacy

At our university...we allow users to declare "privacy" if they choose.
Basically then we have to hide or remove all their identifying information
from the directory. In AD, what is the best way to make an account so it's
basically invisible to all other users except for Administrators?

Remove all the "read" security permissions set on the Authenticated Users
group for that account? Can we just delete the Authenticated Users group
from the accounts security permissions?

Thanks,
Matt


.