Nerdpedes,
have a look at
https://security.stackexchange.com/questions/64915/what-are-the-biggest-security-concerns-on-pxe
Best of:
I can capture a full machine image. Do your systems automatically connect to the domain controller after setting up the machine? If so, this image probably has domain controller credentials on it, that I can capture and use elsewhere.
Computer makes a DHCP request --> DHCP server responds with address and PXE parameters --> Computer downloads boot image using TFTP over UDP
If the good guys got the traffic on that low level, unencrypted. Then they would have it all.
If we have captured traffic showing the PXE communications packets, that would be huge. Otherwise, we just have a 'potential vulnerability' that may or may not have been exploited.
If PXE was used during the election, I believe the built-in OS logs would at least show that since they would have no entries during that timeframe.
PXE operates over Bootp/DHCP routers are often configured as BOOTP/DHCP forwarders. If PXE was turned on their is a chance the router logs would capture it if they were configured as DHCP forwarders.