Do we have a utility with IDM 2 or 3 that creates AD accounts with
sufficient privileges for everything including password synchronization? I
suppose I should know this but so far I've never used it but seem to recall
having it mentioned to me once or twice before. If anybody can give me a
link, name (searchable in Google), or whatever I would be deeply appreciative.

Thanks.