An AccountToPersonMatchingRule with an OR will result in many matches if one of the fields involved is empty (4320809)

Scenario:

For an ADSDomain for ADSAccount, AccountToPersonMatchingRule contains the following:

OR

CentralAccount <-> SAMAccountName
DefaultEmailAddress <-> Mail

This results in ALL persons without DefaultEmailAddress matching ALL accounts without mail.  However, persons/accounts WITHOUT a mail address are to be ignored.

This is a product defect (34415).

WORKAROUND

None

STATUS

This will be fixed in a future release of the product. If you require this immediately corrected, please contact Support for a hotfix referencing the defect ID 34415.