The access token used for Exchange impersonation includes the following SIDs: %4User: %1 %4Group: %2 %4Restricted Group: ...