How to automatically reconcile /etc/group and /etc/gshadow

man had the answer I missed before:

grpconv

http://linux.die.net/man/8/grpconv:

The grpconv command creates gshadow from group and an optionally existing gshadow.