The parent domain we fall under uses Quest ActiveRoles, so we used their web interface or the dedicated client most of the time. From my understanding (as I just used it and didn't install it), AR can allow more granular control of permissions for modifying Active Directory, and provides better stats/change management features. But really it's just a glorified LDAP front end if you're not utilizing it's other features.
Though I also used my fair share of PowerShell and standard ADUC. ActiveRoles has some really, really nice PowerShell cmdlets for AD interfacing that'll work even on a non-ActiveRoles domain.