Tracing through log on/off

http://blogs.technet.com/markrussinovich/archive/2010/01/13/3305263.aspx

XP:

psexec –sid c:\sysint\procexp.exe

Vista+:

psexec –sd –i 0 c:\sysint\procmon.exe

net stop ui0detect
net start ui0detect