If you use Windows Help and Support , located on the start menu, and type in
"eventlog" in the search box, you will be presented with a list.
Choose "Monitor attempts to access and change settings on your computer".
You will find near the bottom "To turn on auditing".
Follow the instructions.
Here is what it says...
To turn on auditing
Click to open Local Security Policy.? ( %systemroot%\system32\mmc.exe
secpol.msc ) If you are prompted for an administrator password or
confirmation, type the password or provide confirmation.
Click Local Policies, and then double-click Audit Policy.
Double-click the event type that you want to audit.
Select the Success or Failure check box, or both, and then click OK.
If you select Success, Windows will record any successful attempts to
complete the type of event that you are monitoring. For example, if you are
auditing logon events, any time someone logs on to your computer would be
considered a successful logon event. If you select Failure, any unsuccessful
attempt to log on to your computer will be recorded. If you select both
Success and Failure, Windows will record all attempts. There is a limit to
how many events can be recorded and, if the audit log gets too full, it can
slow down your computer. To make more space, you can delete events from the
log when you are viewing them in Event Viewer.
