Hi Glenn,
Yes, I have seen your first post that you have already checked the event viewer and CMS logs, however that was for "Adding a new user in CMC" workflow.
Now, I want you to check the same logs after updating the Windows AD plugin in CMC.
Event viewer will capture how many users BI has fetched and from how many mapped groups. It may also show you some warnings for the update. You can also sort the event viewer logs by Source: BusinessObjects_CMS, Category: Security.
Also, please check below two options specified for creating a new user alias->CMC->Authentication->Windows AD.
You would need to check the CMS logs as per the options selected for creating a new user alias. CMS logs will contain all the details about the Windows AD plugin update like domain names, groupss names, perhaps user names, number of users fetched, number of groups mapped, Communication details between BI and AD servers.
You can also try these options one by one to check whether the users are fetched into the BI repository or not. But be careful while playing with the first option which will fetch all of the AD users from the mapped groups and will create users in CMC. So if you have 50k users in any of the mapped groups on the Domain controller then it will fetch all of the users.
I would also suggest you to check whether those users are able to login to BI with their AD credentials or not. We have seen this behaviour in the past wherein BI did not fetch any user but still those users were able to login.
It's important to maintain the confidentiality of the company. So, I will assume that you would not be able to attach the traces here. Well, I no longer work for SAP support, I would love to work with them again though 
~Swapnil