In short: InGroup supports any type of group included in the user token. This includes universal groups.

However, querying for groupmembership on a remote domain or machine does not (can not) rely on the user token, but instead directly queries the remote system. The API involved sadly does not support nested groups. The only workaround for this would be to recursively query all groups on the system, which would be much too expensive in terms of performance and network traffic.

Kind regards,

Ruud