mprov mc [cosName] [zimbraAttribute] FALSE
Revelant [zimbraAttribute] values:
If you haven't configured additional COS's put 'default' inplace of [cosName].
Thus you could have a COS for 'employees' that still can search the GAL, while 'members' COS wouldn't be able to. http://www.zimbra.com/forums/announc...html#post62754
so we know what version you're running (as there was a bug with showing an access error like that when clicking to: with the GAL disabled etc.)
Just for future info:
On individual domains, by default zimbraGalInternalSearchBase & zimbraGalSyncInternalSearchBase are set to DOMAIN. So if you're using multiple domains and still want to leave the GAL enabled, people can only search within their domain. (You can let a domain look across all domains for the GAL by setting that to ROOT. Or lookup in domain and sub.domains by setting that to SUBDOMAINS. If you're using external LDAP/AD auth that's zimbraGalLdapSearchBase & zimbraGalSyncLdapSearchBase.)