When Logon Tracker first runs on an endpoint, it can parse existing logs to identify the logon history for that endpoint. Backfill is enabled by default.
Note
Disabling backfill is not recommended.
Capturing historical logon activity is critical to investigating lateral movement.