It would install a "GRLDR" (GRand Unified Boot Loader) that injected a SLIC table into memory before Windows booted. By the time Windows woke up, it saw a valid certificate, checked the memory, and activated itself permanently.
? I can provide tailored steps if you share the exact issue.