I am replying for Doug since he's on vacation.
We are only trying to sync one child domain out of three. The sync server is in the child domain. The account we are using is a child domain admin account that has also been put into Enterprise Admins in the forest root. It fails but MS says it should work.
Nevertheless, we have also used a native forest account in Enterprise Admins and the process fails at the same spot complaining the account is not in Enterprise Admins.
One other thing I noticed... after the dirsync software installation, should the FIM management agents already exist, but just not be configured? In MIISClient, there are no agents present after installation and before configuration.
Jim