What products do you use to manage identity propagation in your environment?
For example, Joe gets hired at the company. HR inputs Joe's profile in the HR employee management application. A ticket is passed to IT to manually create Joe's Active Directory account, add a bunch of user groups for his job role. They will also manually create Joe's accounts in other disparate systems that don't authenticate with Active Directory. By the time Joe gets all his access, he's already wasted a week on company time twiddling his thumbs and surfing the webs.
Then one day, they found pr0n on Joe's PC, dated back to his first week on the job, and so they showed him the door. Now, all the same people have to repeat the work to undo Joe's access in all the systems he had access to.
The same process also repeats if someone changes job roles, such as to another department.
What I'm looking for is a tool designed for sysadmins to manage user accounts such that changes like these can be fully automated once they're changed in the master database (HR application, in this example).
I'm aware of Microsoft's ILM 2007, and its predecessor MIIS. I find these products poorly documented, entirely too difficult to manage, and I've found almost no support online.
What products might meet this criteria?