I would like to create a rule in a search scope that will exclude any sites that a specific AD group has permissions to. We have some sites that broad AD groups (ie: authenticated users) have access to, but I do not want those sites in the search scope.
Is there any managed metadata property that would allow me to do this?
This kind of functionality is actually available out-of-the-box as Membership sites, where users on their MySite can see what sites they are a member of. SharePoint maintains a list of membership sites for each user - that is a list of all sites where the user is granted access through the SharePoint Member group on sites.
See My Sites overview on MSDN and this related question.
Granted, the Membership sites functionality in SP2007 and SP2010 is not very flexible. It only works with the default Member group on sites. Permissions granted through other groups are ignored.
In SP2013 all this changes as users will simply be able to follow the sites they care about.
I believe Search Results are security-trimmed, so users only see search results that they are able to access.
From http://msdn.microsoft.com/en-us/library/aa981314.aspx:
"By default, Enterprise Search results are trimmed at query time, based on the identity of the user who submitted the query. When results are returned for a user's search, the Query engine performs an access check for the user's identity against the security descriptor stored in the content index for each item in the search results. The Query engine then removes any items in the search results that the user does not have access to, so that the user never sees these results."
