During LDAP sync there are a plenty of AD logon Events visible on our Domain controllers, usually with event ID 4648, 4624 (impersonation).
Is there a reson that LDAP bind user do impersonation, and authenticate so many times. (more than thousand) I think it authenticates on every user during query.