somehow the server has to know whether the presented ticket from the client is valid.
In the Microsoft Active Directory implementation of Kerberos, the privileges and roles (group memberships) are stored in a part of the Kerberos token called the Privileged Attribute Certificate (PAC). When a token is presented to another system or process, the PAC is evaluated to determine if they have access, usually by group membership.
It is possible for Windows to validate the PAC. This is typically performed as an integrity check to ensure that it isn't forged. However, PAC validation is intended to occur in specific circumstances, such as when an application which is trusted for delegation attempts to reuse a Kerberos ticket from an impersonated or delegated user which it has already locally cached.
If validation of the PAC were performed, the Windows Netlogon service simply sends a PAC validation request to the local domain controller as described here:
4.2 Kerberos PAC Validation
However, if a process has Act As Part of the Operating System privilege, PAC validation may not occur. Note that if IIS is using integrated authentication and performing delegation-level impersonation of authenticated users, it may be required to have Act As Part of the Operating System privilege.
Also, if you are only authenticating users and using their token groups to grant access and not impersonating their token, a PAC validation may not occur.