ANR双等号(==)查询异常：为何返回两个AD用户结果？

Let's break down why you're seeing two results instead of the single one you expected.

First, let's recap how the ANR (Ambiguous Name Resolution) filter works when using double equals (==):

You can force ANR to require an exact match on any of the attributes in the table by starting the value with the equal sign, "=" (so the filter has two equal signs)

The key point here is that ANR checks against a set of default attributes (not just one specific attribute you might be thinking of). By default, these attributes include givenName, sn (surname), name, sAMAccountName, displayName, and others depending on your AD environment.

Now let's look at your two users:

1. CN=Leon1,CN=Users,DC=LH269,DC=com
   • Its sn (Surname) attribute is Leon — since AD attribute matching is case-insensitive, this counts as an exact match for leon.
2. CN=Leon, Jennifer,CN=Users,DC=LH269,DC=com
   • Its sAMAccountName attribute is leon — this is a direct, case-insensitive exact match.

Since both users have at least one attribute in the ANR set that exactly matches leon, both get returned by your filter.

If you want to target only the specific user you expected, skip ANR and use a direct attribute filter instead. For example, to match the sAMAccountName exactly:

Get-ADUser -LDAPFilter '(sAMAccountName=leon)'

Or to match the full name attribute:

Get-ADUser -LDAPFilter '(name=Leon\, Jennifer)'

内容的提问来源于stack exchange，提问作者ilansch