I had issues with this also, and I found that the user account which was querying active directory did not have correct rights to view group memberships on all accounts.  Make sure that the user account you are using has the correct permissions for this in AD.

Also, if you change the username which is being used, be sure to restart the application (either by modifying the web.config file and saving it or through the host settings menu)  because the new username won't take affect until this is done.  What I did to troubleshoot this is try a domain admin for testing.

Also, the groups names have to exist in DNN for the synch to work (IE, only synchs to existing groups, doesn't bring in new ones) and this got me: group names are case sensitive.

Please let me know if this provided any help.

You can log into a workstation with the credentials of the account, and open Active Directory Users and Computers and spot check a few of the accounts which don't seem to be synching properly by looking at the "Member of" tab to make sure you can see all of their group memberships.