By default, the Directory Server denies all unindexed search requests, except for those issued by the bind DNs that have the unindexed-search privilege. This default behavior keeps the server from tying up worker threads on time-consuming, unindexed searches. However, you can turn off the enforcement of the unindexed-search privilege to allow any client to perform an unindexed search. To do this, set the disabled-privilege global configuration property to unindexed-search as follows:

$ bin/dsconfig set-global-configuration-prop \
  --set disabled-privilege:unindexed-search

If you choose to allow unindexed searches, you may want to cap the maximum number of concurrent unindexed search requests using the maximum-concurrent-unindexed-searches global configuration property. You configure this property using dsconfig as follows:

$ bin/dsconfig set-global-configuration-prop \
  --set maximum-concurrent-unindexed-searches:2

You can limit unindexed search privileges for particular clients using the allow-unindexedsearches property of the Client Connection Policy. For more information about configuring Client Connection Policies, see “Configuring Client Connection Policies”.