Marche has some very good solutions, please be sure mark them as correct. My suggestion is down a different path, we have a very high volume of generic accounts and they are in two separate OUs, one for zero clients and one for standard systems. We have a need for each group to get a particular set of GPOs and that is what works for us.
Note: multiple RDNs can be added to the same LDAP servers pointing to several different OUs. SNow does not have root access to our AD, nor does it pull all object attributes. This is for best practices in Security and Performance.
