After migrating users from one active directory domain to another, we needed to force K2 to re-resolve groups to members in a workflow instance.