Unfortuantely, I can't install anything for testing.  So, I can't try it. 

I just ran a test.  In my web.config file, I found the authentication = Forms/Windows thing.  This is what I have right now. 

            <authentication mode="Forms">
                 <forms name=".DOTNETNUKE" protection="All" timeout="60" cookieless="UseCookies" />
           </authentication>
           <!-- 
              <identity impersonate="true"/>
              <authentication mode="Windows">
              </authentication>
           -->  

I tested out uncommenting the impersonation and Windows authentication mode (and commenting the top half).  It seemed to have worked.  Users roles were not being dropped, but I could not get a new person to login.  It would get stuck in a loop.  So I had to put the Forms authentication back on. 

Any ideas?

Nothing I do seems to work.  I ended up unchecking Synchronize so that Roles aren't deleted.  Unfortunately, this means that I have to manually add in Roles for new users. 

Yes this has happened to me on a live site where only 1 out 5 groups stopped working.  I had to turn sync off on that portal like you did.  I have not figured out the cause or the solution yet but mine started on the 1st of this month.  I have 1 untested lead so far - and that is the group that stopped working was a Global AD Role while the the roles that remained working were Universal.  My other thought it is a MS patch or configuration change.   Let me know if you have any success on the fix.

Craig