I don't really know how the "enterprise" solutions work, but I imagine they get the disk decryption key from AD or something, and thus the IT support team can "

I don't really know how the "enterprise" solutions work, but I imagine they get the disk decryption key from AD or something, and thus the IT support team can "reset" disk encryption. There are a variety of threat models, and whether or not this is acceptable depends on the worry that you have. If you are concerned that the IT department is going to decrypt executives' laptops and leak confidential information, then this isn't a good model. But if you're merely concerned that someone leaves their laptop in an airport, it's fine -- whoever picks that laptop up and resells it won't hack your directory system and be able to decrypt it. A long memorized passphrase that only one person knows is the best possible way to prevent unauthorized access, but that isn't necessarily the problem that you're trying to solve with disk encryption.