Access token related query

Hello Support Representatives,

I have general query regarding Access Token. I hope you guys will answer and explain it.

So during migration, servers(containing resources) have been migrated from source domain to target domain. Source Domain Local groups are appended in resource DACL. These source domain local groups have been migrated to target domain without Sidhistory and during migration group scope has been changed to "Global". These migrated global groups nested inside source domain local groups.

If target domain users are member of migrated global group and target users login to target domain joined workstation, then what Sids will be included in access token? Will Access token include both - Sid of migrated target group as well as Sid of source domain local groups? 

Please clarify - Does access token of user contain Sid of recursive groups which are inter domain and scope not matching to direct group of user as per above example.

Another scenario: This time Servers (containing resources) are in source domain only. Source Domain Local groups are appended in resource DACL. These source domain local groups have been migrated to target domain without Sidhistory and during migration group scope has been changed to "Global". These migrated global groups nested inside source domain local groups. If source and target domain users both are member of migrated global group and target users login to target domain joined workstation and source users login to source domain joined workstation then what Sids will be included in access token? I guess target users will not be able to access resource as his token will not include source domain local group because he logged in via target domain joined workstation. But what about source user login to source domain joined workstation, will his access token include both - Sid of migrated target group as well as Sid of source domain local groups? 

Please clarify - Does access token of user contain Sid of recursive groups which are inter domain and scope not matching to direct group of user as per above example.

Please answer and explain both scenarios. 

Parents Reply Children