View events generated (good for forensic research) when actions occur. Just run Get-EventDiff then press another key to stop listening.

Get-EventDiff.ps1

function Get-EventDiff
{
    $startTime = [datetime]::Now
    Write-Warning "Press any key to stop listening for generated events ..."
    $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") | Out-Null

    # set an endtime in case the Get-WinEvent query takes a few seconds to complete
    $endTime = [datetime]::Now
    Get-WinEvent -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt $startTime -and $_.TimeCreated -lt $endTime }
}