Just enable event auditing on the computer. Then look in the Security event logs and you'll see.