Lets look at the effect in AD Users and Computers. The first view is the view as seen by a user with no restrictions:

 When logging in as the Helpdesk User and view the list of available Mailbox Stores I see the Mailbox Store list MINUS the VIP store as desired.

Opening Exchange System Manager as the Helpdesk user reveals the added benefit of hiding the VIP store object in this utility as well. Mailbox Store’s are not the only object type that may be hidden from view in either AD Users&Computers nor Exchange System Manager. Administrative Groups, Routing Groups, etc may all be hidden from view to provide a simplified administrative view or a limited view while manipulating possible values on a users exchange attributes.

 Editing the ALC (Access Control List) on the Mailbox Store object can also be done using ADSIEDIT or a 3’ rd party utility or script. I prefer using third party tools for their obvious benefits. Testing, documenting and providing rollback play an important part in modifying permissions in Active Directory. As mentioned previously, editing at this level without thoroughly understanding the effects can be dangerous. I suggest proving functionality in a lab first, documenting it and using a trusted guaranteed method such as a script or utility to roll it out.