filter="(&(AllowAccess=Y)(uid=bill))" AllowAccess is unindexed attribute uid is indexed attribute access log search result: notes=U I imagine that directory server will do an indexed search by uid=bill, get the entry and then verify if AllowAccess=Y. To me this kind of search is indexed search. example: [18/Jan/2013:10:17:24 -0500] conn=124757 op=1 SRCH base="ou=people,dc=?" scope=1 filter="(&(AllowAccess=Y)(uid=bill))" attrs=ALL [18/Jan/2013:10:17:24 -0500] conn=124757 op=1 RESULT err=0 tag=101 nentries=1 etime=0 notes=U etime=0 confirms that this search is fast. -- 389 users mailing list 389-users@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/389-users