title: Can PAC information in user's kerberos ticket have trusted domain's group memberships
body: <p>We have an application which reads and verifies the group memberships from the PAC info. There is a customer situation where the PAC contains group memberships from another domain(in forest trust with primary domain). And this other domain is offline so our app can't validate these groups and failing.</p>
  
  <p>I can't seem to understand which groups might these be. I tried adding my primary domain users to trusted domain's "domain local groups" but those groups don't show up in the PAC.</p>
  
  <p>Can't ask the customer since they are not cooperating. I wish to recreate the issue locally.</p>
  
  <p>Any suggestions which groups might these be ?</p>