New user and computer accounts are created in the CN=Users and CN=Computers containers by default. It is not possible to apply Group Policy directly to these containers, although they inherit GPOs linked to the domain. To apply Group Policy to the default Users and Computers containers, you must use the new Redirusr.exe and Redircomp.exe tools.
Redirusr.exe (for user accounts) and Redircmp.exe (for computer accounts) are two tools that are included with Windows Server 2008. These tools enable you to change the default location where new user and computer accounts are created, so you can more easily scope GPOs directly to newly created user and computer objects. These tools are located on servers with the Active Directory Services Role in %windir%\system32.
By running Redirusr.exe and Redircmp.exe once for each domain, the domain administrator can specify the OUs into which all new user and computer accounts are placed at the time of creation. This allows administrators to manage these unassigned accounts by using Group Policy before the administrators assign them to the OU in which they are finally placed. Consider restricting the OUs used for new user and computer accounts by using Group Policy to increase the security of these accounts.
Source : Technet
http://technet.microsoft.com/en-us/library/cc754948%28WS.10%29.aspx
7 IT & Security 