Cisco VPN authentication

I have recently found run into a Kerberos/Active
Directory issue that limits compatibility with Cisco 3000
series VPN's. The issue revolves around the sidHistory
attribute in the Active Directory. In short if this
attribute is present and the value is greater than 3
groups the authentication fails. The value is present
because of migrations from NT4 to 2003 using the ADMT v2
tool. Place great care in migrating user who will become
members of nested groups or multiple groups. The
migrated users sidHistory increase with the tokengroup
attribute.