I recently had a similar issue.  Trying to fathom the output of sys.login_token (in concert with EXEC AS LOGIN = 'foo') helped.  I had one domain group which was...