Currently the laptops in use are encrypted using Pre-Boot-Authentication, so the entire disk is encrypted. A user has to enter a password before booting the operating system.
A new concept suggests using the laptops TPM to store the key. While the disk itself is still fully encrypted, the boot process continues until the Windows Login Screen without the user entering a password.
On these laptops, USB-drives are not blocked before login and BIOS (tries to) prevent(s) booting from another drive (which can probably be bypassed). In my opinion, this makes the Full-Disk-Encryption as secure as the Windows login screen, which is a considerable downgrade.
The question is:
Is allowing the boot process to continue until the Windows Login Screen without requiring the user to enter a password considered secure?
Which attack vectors can be used and are they just academic problems or reasonably possible?
Assume the laptops are corporate devices, containing potentially sensitive/internal data. I argued that any flaw in the Windows Login Screen effectively kills the Full-Disk-Encryption. Any software like KonBoot may be used to nullify the encryption. A colleague mentioned, that employees leave their devices in sleep mode 80-90% of off-work hours, so it doesn't really matter, even when using the pre-boot-authentication which is currently in place.