Question: I've got an installation of Plone 4.2.1 running nicely, but visitors to the site can click on the Users tab in the main menu and go straight to a search of all my registered users. Certainly, anonymous visitors are unable to actually list anyone, but I don't want this functionality at all.

What's the Plone way of:

* removing the Users tab from the main menu?
* stopping the URL /Members returning anything except 404?

Are there other effects of this functionality I should be aware of?

Answer: 
The `Users` tab is only shown because there is a `Members` folder (with the title `Users`) in the root that is publicly visibile.

You have three options to deal with the default; make the `Members` folder private, delete it altogether, or remove the `index_html` default view.

Unpublish
---------

You can 'unpublish', retract, the folder workflow to make it private, and anonymous users are then redirected to the login form instead of seeing the user search form:

![how to retract the Users folder](https://i.stack.imgur.com/3X2w3.jpg)

Simply go to the folder, click on the workflow state (`Published`) and choose `Retract`.

Delete
------

If you do not need to have per-user folders, you can remove the `Members` folder altogether. You do need to make sure that user folder creation is not enabled first. Go to the Control Panel (click on your username, top right, select `Site Setup`):

![Control Panel link](https://i.stack.imgur.com/SkHAp.jpg)

select `Security`:

![Security entry in the CP](https://i.stack.imgur.com/DvM5a.jpg)

and make sure that `Enable User Folders` is not checked. If it is, uncheck it and save the settings.

Now just delete the `Members` folder; click `Users`, find the `Actions` menu on the right, then select `Delete`:

![Users deletion](https://i.stack.imgur.com/fiEjl.jpg)

then confirm the deletion in the popup:

![Users deletion confirmation](https://i.stack.imgur.com/I20Yf.jpg)

Deletion means *all* users will get a 404 when visiting `/Members` in your site.

Delete the default view
-----------------------

The `Members` folder contains a `index_html` object that provides the user form search. If all you want to get rid of is this view, you can delete it. If your `Members` folder is still public, visitors *can* see any userfolders that have been created though.

Deleting this view requires going to the ZMI, the Zope Management Interface, navigating to the `Members` folder and deleting the `index_html` object there.

Since this is not really the recommended course of action I'm leaving out the screenshots for this part.
You can just delete the Users folder.