c# - Global catalog says that user from DomainA belongs to Domain Users from DomainB -

i trying detailed information user's group membership using directory services queries global catalog. don't want use getauthorizationgroups() because it's flaky.

there 2 domains: domaina , domainb. global catalog server domain controller domainb. finally, there user (usera) part of domaina.

i find usera in global catalog , @ tokengroups property sids of groups usera belongs.

to great surprise, find domainb\domain users included in list. why being included, given usera not part of domainb?

here code i'm running:

using (directoryentry gc = new directoryentry("gc:")) {     string userprincipalname = "usera@domaina.local";      directoryentry searchroot = null;     gc.authenticationtype = system.directoryservices.authenticationtypes.secure;      // there 1 child under "gc:".     foreach (directoryentry de in gc.children)     {         searchroot = de;         break;     }      using (searchroot)      {         searchresult samresult;         using (var samsearcher = new directorysearcher())         {             // find user.             samsearcher.searchroot = searchroot;             samsearcher.filter = "(userprincipalname=" + userprincipalname + ")";             samsearcher.propertiestoload.add("distinguishedname");              samresult = samsearcher.findone();         }          list<byte[]> tokengroups;         using (directoryentry theuser = samresult.getdirectoryentry())         {             theuser.refreshcache(new string[] { "tokengroups" });              tokengroups = theuser.properties["tokengroups"].cast<byte[]>().tolist();              identityreferencecollection irc = new identityreferencecollection(tokengroups.count);             foreach (byte[] groupsidbytes in tokengroups)             {                 irc.add(new securityidentifier(groupsidbytes, 0));             }              list<string> groupnames =                  irc.translate(typeof(ntaccount), true)                    .cast<ntaccount>()                    .select(a => a.value.tostring())                    .tolist();              return groupnames;         }     } }