Tracing through log on/off
http://blogs.technet.com/markrussinovich/archive/2010/01/13/3305263.aspx
XP:
psexec –sid c:\sysint\procexp.exe
Vista+:
psexec –sd –i 0 c:\sysint\procmon.exe
net stop ui0detect
net start ui0detect
http://blogs.technet.com/markrussinovich/archive/2010/01/13/3305263.aspx
XP:
psexec –sid c:\sysint\procexp.exe
Vista+:
psexec –sd –i 0 c:\sysint\procmon.exe
net stop ui0detect
net start ui0detect