Generate a script with the group memberships, and all the permissions assigned to these groups. Then drop the groups, and re-add them in the same order they appear in the production system. Confirm the groups have the same GIDs. This should only have to be done once, as the bcp out of the sysusers table should cover any future refreshes.