I recently noticed that my new build in 7.1 DS were not getting the policies that used the AD filters that matched Primary Users to Machines when doing an AD Group Import. After digging around I found out why. When the Prepare Image Task is run it doesn't clear out the current Primary User Data. So once you do build a machine with your new image, the local admin account will be assigned as the primary user.

I found this KB on how to clean it up and built a task to clean out the primary user info but this should be included in the built in "Prepare Image" task.

http://www.symantec.com/docs/HOWTO7989