NirSoft has nice utility that can generate a log of actions made by the user and the events that have occurred on a computer. It is called LastActivityView. It is described on this page from the developer. The download link is near the bottom of the page. The utility requires no installation and can be run from anywhere convenient. A number of languages are available.
The download is a ZIP file containing a small executable 100 KB file, a CHM help file, and a readme file. It works on Windows XP on up, including Windows 8, and on both 32- and 64-bit systems. The utility does not have to be running until you want a report. Click the executable and the report is generated. It lists activity as far back in time as is available from the Registry, the events log of Windows, the Prefetch folder, the MiniDump folder and other sources. An example of the utility display is shown in the screenshot below. Like all apps of this type, it will trigger a UAC challenge. One glitch I encountered is that I couldn't open the Help file from the menu bar but had to go to the CHM file and open it directly.
The developer’s page contains a list of the various types of activity that are recorded. These include: running any.exe file, accessing the open/save dialog-box, opening file/folder from Explorer or other software, software installation, system shutdown/start, application or system crash, network connection/disconnection and more.
The information can also be saved as a CSV, HTML, or text file as explained on the developer’s site. Although the entries may not always seem very informative at first glance, right-clicking an entry and choosing “Properties” provides additional information. For example, an entry “Software Installation” will show the kind of detail shown in the next screenshot.
Use this utility and you will always be able to check what’s been happening on your computer.
From http://www.techsupportalert.com