When you boot Windows , there are many actions which take place in the form of user account, events, programs etc. When some changes are made to Windows, it is very difficult to find which process made the change although you can check the log.

See more here:
Get Detailed Activity Log of Windows