Hi Jason!

You situation may be a great use-case for ADSI Scriptomatic!(http://technet.microsoft.com/en-us/scriptcenter/dd939958.aspx).  

Can I ask why you need to reset the Primary Group to Domain Users?  I'm very interested in what scenario you're working with that is relying on them.  To my knowledge, Primary Groups only affect Windows 2000 functional level domains, Macintosh clients, and POSIX-compatible applications.