You can also use Process monitor to capture data during a boot, logon or logoff.

• 在一个导入，登陆或者注销期间，你也能够使用Process monitor去捕获数据。