I had a user who has about 900 groups (some of them were nested so I suspect there was about 1000 groups) and he couldn't log in returning error stating that there are too much IDs. I have run a script to count his token size and it turned out to be about 24K. We have set a limit to be 64K. User had nothing in SID history as he was never migrated.
Script: https://gallery.technet.microsoft.com/scriptcenter/Check-for-MaxTokenSize-520e51e5
I have also read this articule: https://support.microsoft.com/en-us/help/327825/problems-with-kerberos-authentication-when-a-user-belongs-to-many-grou
But first it says that there is fixed number of groups per user, but then it says that if we set MaxTokenSize to 64K each user can have like 1600 Domain Local groups.
I just wonder what is the point of setting the MaxTokenSize while there is maximum number of AD groups allowed for user? I guess I'm missing something here