Suppose you have an application running on a customer's machine.  They inform you that the application has been unable to create something, or unable to read something.  You suspect some kind of issue with the permissions the program has to read or write, but aren't sure what is being read or written.  The security logs are no help; developers have to explicitly enable that logging, even if you have turned on maximum logging.

 You could fire up a user mode debugger, like windbg, load symbols, and try to figure out where it is failing.  However, a much, much easier method is to log the file and registry activity between the program and the operating system.  This is where the tool http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx Process Monitor comes into play.  Just run the executable, and look at the activity filtered by your running process.