Enable Process tracking auditing Start -> Settings -> Control Panel -> Administrative tools -> Local Security Settings

Goto Local Policies -> Audit Policy, and enable Success and Failure auditing and click OK. You should then see events such as program starting and exiting in the Windows Security Event Log with the category Detailed Tracking.

http://technet.microsoft.com/en-us/l.../cc775520.aspx