User sync not finding all users

I'm in the process of transitioning our device licenses over to shared device licenses. We're a school district, so we had to hold off until summer to make the change.

I have everything set up for the user sync tool on a server, and it's able to connect to our AD server and search. When I point it at a group of 10 users (as a test), it only says it would create 8 accounts when I run the sync tool in test mode. I created a nested group in AD, changed the group membership config as documented ( Advanced Configuration  ), added the initial group of 10 to that group, and another group with 4 users in it, and it still said it would only create the same 8 users when I ran the sync tool in test mode.

Just to see what would happen, I pointed the config at our group in AD that contains all staff users (> 800), ran the sync tool in test mode again, and it still said it would only be creating the same 8 user accounts as before.

I'm stumped here. Ultimately, I need to have it sync a total of 7 groups. It doesn't matter to me if I have to set them up as a nested group in AD, or configure 7 different group definitions in the sync tool config, I just want it to work properly and sync everyone that it should be.

What am I missing here?