Actually, you should be able to do it by removing a hidden system file which tells OS X that setup has run. Delete this file:

/var/db/.AppleSetupDone

It's a hidden file, so you will have to remove it using Terminal, or show hidden files in Finder. You can remove the file like so:

rm /var/db/.AppleSetupDone

To show hidden files in Finder, type the following into the Terminal:

defaults write com.apple.Finder AppleShowAllFiles -bool true

…and then restart Finder.

Suspect an issue affecting the WindowServer process (long edition)

• a more generic edition of this answer appears under How do you get system diagnostic files from OS X?

• power users may prefer to read nearby Suspect an issue affecting the WindowServer process (brief edition …)

The symptoms you describe are familiar but not commonplace and in my case, not frequent.

Prepare for diagnosis

In Terminal, run the following command. Be prepared to enter your admin password for the operating system:

sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.stackshot.plist

Take a written note of the following key chord, you'll need it later:

Control-Option-Command-Shift-.

Diagnosis by the system

When the problem occurs:

1. use the key chord
2. for at least ten seconds, touch nothing
3. allow maybe five or ten minutes for all parts of the so-called sysdiagnose routine to complete – simply wait as long as you can (with this approach there'll be no on-screen indication of progress)
4. force a restart of the computer (Command-Control-Power).

After the computer starts:

1. in Finder, go to /private/var/tmp
2. seek a file or folder with a name beginning sysdiagnose_
3. if that file or folder exists, move it to a convenient place – your desktop, maybe.

Hint

Whilst I don't encourage carelessness, you can be a little careless with Control-Option-Command-Shift-. … if you struggle to avoid the fn key on your laptop, don't worry; including it by accident should not prevent the run of sysdiagnose.

Human analysis of diagnosis by the system

Hint: someone might like to ask a separate question about analysing the results of sysdiagnose – a more generalised answer could be useful.

If sysdiagnose_… from the /tmp area is a folder

Presence of a sysdiagnose_… folder (not a .tar.gz file) indicates that either:

• the routine was interrupted before completion; or
• some part of the routine could not complete.

If sysdiagnose_… from the /tmp area is a file

Presence of a sysdiagnose_….tar.gz file indicates that all parts of the sysdiagnose routine completed, and that the results were archived. If you wish, open the archive – its contents will appear as a folder.

Folder contents at a glance

In the first screenshot below – an example of a completed run of sysdiagnose - I have selected two of the items that may be of interest in a case such as this.

Note that it may be normal to find at least one empty file.

Amongst the .crash, .hang and .spin files – or in the top.txt file – might be a good sign of what was wrong shortly before, or during, the period when you lost control of the computer.

Related:

• How does 'stuck' (in results of 'top') relate to 'not responding' (in Activity Monitor), 'spin' or 'hang'?

For an incomplete run of sysdiagnose it may be useful to focus some attention on files that are abnormally empty …

Technical

stackshot(1) OS X Manual Page

sysdiagnose(1) OS X Manual Page