Dont get me wrong, there are some things a keylogger can do that you can't dig out with software. I wouldn't say the bios password logging is a good example (that is the simple to get by, either jumper the CMOS to clear it, or pull the drive if they locked it from preventing bootup). I would say its a good way to monitor a workstation to see what ID's they are using to access servers, things not reguarly cached anywhere.