This happened to me yesterday, and I just want to rule out that anything malicious was going on.
I should probably also mention that it switched back to Aero after a minute or two.
edit: I have found the event in the log, IDs 9013 and 9010:
The Desktop Window Manager was unable to start because composition was disabled by a running application
A request to disable the Desktop Window Manager was made by process (Windows System Assessment Tool)
It was under Windows Logs -> Application in the Event Viewer.