diff --git a/main.go b/main.go
index a05bda8..fd0c279 100644
--- a/main.go
+++ b/main.go
@@ -360,7 +360,7 @@ func (server *Server) handleSearchInternal(state *State, w ldap.ResponseWriter,
 		// TODO filter out if no permission to read this
 		matched, err := applyFilter(entry, r.Filter())
 		if err != nil {
-			return ldap.LDAPResultOperationsError, err
+			return ldap.LDAPResultUnwillingToPerform, err
 		}
 		if !matched {
 			continue