> I don't really know how the "enterprise" solutions work, but I imagine they get the disk decryption key from AD or something, and thus the IT support team can

> I don't really know how the "enterprise" solutions work, but I imagine they get the disk decryption key from AD or something, and thus the IT support team can "reset" disk encryption. They don't get it from AD so much as Group Policy can be configured to have the device store the key in AD, but otherwise yes that's how it works.