Question: does AD send a user's access token across the network?
Research: The following two passages contradict themselves--given that TGTs are transmitted across the network by design.
From the 5th Edition of Active Directory by Oreilly:
Most importantly, the user's access token is stored in the TGT. The access token includes important information such as what groups a user is a member of, the user's NT rights, and Dynamic Access Control (DAC) claims.
From Windows Server 2008 Active Directory Resource Kit by Microsoft Press:
The access token is used by the security subsystem whenever a user tries to access a resource. When the user tries to access a local resource, the token is presented by the client workstation to any thread or application that requests security information before allowing access to a resource. The access token is never transmitted across the network to another computer; rather, a local access token is created on each server where the user tries to access a resource. For example, when a user tries to access a mailbox on a server running Exchange Server 2007, an access token is created on the server.