We have a customer on a group licensing server whose employees are able to search in folders they aren't supposed to see. They are set up where they cannot see the folder upon browsing, but are able to see if they search.  We've been rattling our brains through the rights and permissions. But nothing seems to fix the problem. What are we missing?

Thank you for the help.