I'm working with a customer who is using qmm to migrate ad and exchange from sourcedomain to targetdomain. User and group objects were all migrated from sourcedomain to targetdomain some time ago, and have kept in sync with the DSA with a one-way sourcedomain to targetdomain syncronization since that time. For most groups and users, this is working great. Passwords and everything is kept in sync. However, occasionally some group memberships are not being updated. For example, GroupA was migrated from Sourcedomain to targetdomain. It has four users and eleven groups in it. Months later, GroupA in SourceDomain is modified, removing all four users and four of the groups from the membership. Days later, this change has not been syncronized to targetdomain. All users and groups are configured to be in the scope of the sync process. As a troubleshooting step, i add another user to GroupA on the source, and it gets synced to GroupA on the target. If i remove that user on the source, it is removed from target group as well.
As an additional troubleshooting step, I also added one of the original four users to GroupA back in the source group, and waited ample time for the sync process. Since they were still in the target group, no change was observed. However, when i removed that user from GroupA on the source, the sync processs then removed them from the target group.