It's measured boot with the TPM getting measurements of the system state during all steps up to the Windows Boot Manager. (and including the Windows Boot Manage

It's measured boot with the TPM getting measurements of the system state during all steps up to the Windows Boot Manager. (and including the Windows Boot Manager configuration data) If all the measurements match, the TPM releases the volume encryption key and the system can boot. If you boot from an external volume and then modify the boot configuration or the OS loader, or reflash the UEFI firmware, the measurements won't match and the TPM won't give the key. Of course, if the login prompt, which runs way afterwards is buggy, drive encryption in Windows won't save you there. An advantage of this system is that when you reboot, all your services can run before you input your password, and you can login remotely. That's an absolute must for a lot of business use cases.