Windows honeypots for forensic analysis

Hi All,


Has anyone here used Windows virtual machines or devices as a honeypot(s) to capture malicious activity and artifacts?

I'm interested in gathering logs, pcaps, memory and images much like the content published by the [dfir report](https://thedfirreport.com/). I'm curious to hear what risks and challenges were faced, as well as what lessons were learnt.
Cheers

analysis computerforensics forensic forensic analysis honeypots windows