Redirecting you to Reddit in 5 seconds:
https://old.reddit.com/r/netsec/comments/1dhy0ht/microsoft_windows_endpoint_forensics_readiness