[aesh2Xa1]

You can usually lock the whole system with a boot password. In the case where the attacker replaces the whole disk, or whole disk image with another Windows image, you can also add your own keys and sign the image or individual boot files.