This week I talk about investigation strategies for logon events.