Is there any way to do this directly (e.g. simply get a refence to the
foreign domain user and list the groups it belongs to in the local domain)?
I haven't come across any examples of this being done and I can't think of
any way other than to check for the foreign domain users' SDDLs in each of
the local groups.