Using gMSA with ATP results in many 2947 events

EliOfek  We have the same issue. All is set up correctly. We only have gMSA but we have multiple forests. For every doamin we have a gMSA. This has logon-as-a-service on the DC and the gMSA is installed on the respective DC. Also, the PrincipalsAllowedToRetrieveManagedPassword for the gMSA contains a universal group of which the DC is a member.

Yet, we see a lot of 2947 events. The log shows 

2022-05-18 10:30:01.8472 Info RemoteImpersonationManager GetGroupManagedServiceAccountTokenAsync finished [UserName=gMSAxxxx$ Domain=forest1.local IsSuccess=False]
2022-05-18 10:30:01.8472 Info RemoteImpersonationManager CreateImpersonatorInternalAsync finished [UserName=gMSAxxxx$ Domain=forest1.local]
2022-05-18 10:30:01.8472 Warn DirectoryServicesClient CreateLdapConnectionAsync failed to retrieve group managed service account password. [DomainControllerDnsName=unix.local Domain=forest1.local UserName=gMSAxxxx$ ]
2022-05-18 10:30:01.8472 Info RemoteImpersonationManager CreateImpersonatorInternalAsync started [UserName=gMSAxxxx$ Domain=forest2chld.local IsGroupManagedServiceAccount=True]
2022-05-18 10:30:02.5503 Info RemoteImpersonationManager GetGroupManagedServiceAccountTokenAsync finished [UserName=gMSAxxxx$ Domain=forest2chld.local IsSuccess=False]
2022-05-18 10:30:02.5503 Info RemoteImpersonationManager CreateImpersonatorInternalAsync finished [UserName=GMSY000001$ Domain=forest2chld.local]
2022-05-18 10:30:02.5503 Warn DirectoryServicesClient CreateLdapConnectionAsync failed to retrieve group managed service account password. [DomainControllerDnsName=unix.local Domain=forest2chld.local UserName=gMSAxxxx$ ]
2022-05-18 10:30:02.5503 Info RemoteImpersonationManager CreateImpersonatorInternalAsync started [UserName=gMSAxxxx$ Domain=forest2.root IsGroupManagedServiceAccount=True]
2022-05-18 10:30:03.3316 Info RemoteImpersonationManager GetGroupManagedServiceAccountTokenAsync finished [UserName=gMSAxxxx$ Domain=forest2.root IsSuccess=False]
2022-05-18 10:30:03.3316 Info RemoteImpersonationManager CreateImpersonatorInternalAsync finished [UserName=gMSAxxxx$ Domain=forest2.root]
2022-05-18 10:30:03.3316 Warn DirectoryServicesClient CreateLdapConnectionAsync failed to retrieve group managed service account password. [DomainControllerDnsName=unix.local Domain=forest2.root UserName=gMSAxxxx$ ]
2022-05-18 10:30:03.3316 Info DirectoryServicesClient TryCreateLdapConnectionAsync failed [exception=Microsoft.Tri.Infrastructure.ExtendedException: CreateLdapConnectionAsync failed [DomainControllerDnsName=unix.local]

 This is on a DC in a forest forest3.local (not present in the log above). It seems that it tries to find an account for the unix.local 'domain' (it is a Unix based LDAP, there is a trust between forest2chld.local and unix.local as wel as a two-way trust between forest2.root and forest3.local). It will never succeed.

IMHO it may try this one time, log a message and give up. But is it very agressive and floods the log...

Please Microsoft - there is more in the world than Windows/Active Directory.