What's the best tool for automating active directory management?

We're using SailPoint IdentityIQ for account provising automation.

And the process of adding or removing access to Active Directory starts within Workday when we create the employee.   It triggers calls to IdentityIQ and to other systems.

1. PowerShell
2. ManageEngine ADManager Plus
3. Quest ActiveRoles Server

I'm told that ManageEngine does a solid job...

If you're looking for a solution that helps from a security perspective, I'm very partial to Semperis Directory Services Protector (I work at Semperis).

I like GroupID by Imanami. It does a great job and still is cost conscious.