As far as I've read, it's more targeted at corporate deployments when the owner/administrator and user aren't the same person or authority. It allows things like remotely reimaging the machine if the OS install gets screwed up, deleting encryption keys if the machine is stolen or otherwise compromised, verifying that the mandatory "endpoint protection suite" is actually running, etc..