This was answered in another thread here (superuser), The solution name is: UAC Auditing.
Source: https://superuser.com/questions/273236/reason-for-user-account-control-dialog
Edit for essinital part: (Summary of the URL above)
Uac Auditing is done by changing windows policy (Local\Group). The
policy in interest is found at:
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy
Audit Privilege Use will give you information about elevated usage using the UAC consent.exe dialog box in the System Event log. The
Event IDs created by this: 4648 and 4624.
Audit Process Tracking will give you information about processes and their creation/termination. Event Id created by this: 4688.
Also, look at event id 4696 to see when a new token (user-logon
handle) was assigned to process. Using all these events, you can get a
clear picture of the timeline for every process that requested an
elevated rights with UAC dialog.
Here is a site containig a short summary for every Event ID in the System Event log:
Description of security events in Windows 7 and in Windows Server 2008 R2
http://support.microsoft.com/kb/977519
Edit 2:
Not all Windows versions has a Policy editor included (like Windows 7 Home premium). However, Local Audit Policy editor (Not Group Policy) is accesible in Windows 7 Home Premium with Auditpol.exe and on Windows XP SP2 with Auditusr.exe
For more information about using Auditpol.exe see here:
http://technet.microsoft.com/en-us/library/a02cfb9d-732f-4e77-aeba-f18265daa3af