1. None. Anonymous binds on rootDSE are required as part of the LDAP v3 specification to determine the list of supported LDAP SASL bind methods. An Anonymous LDAP bind to Connection Server doesn't allow any Connection Server configuration to be accessed. You can try this with LDP.exe.

2. No. LDAP v3 binds would not work if we did this.

3. No.

Mark