This week we continue with the Windows fast triage series and talk about lateral movement evidence that may be found in logon event records.