I have an auditing reason for needing to maintain a log of WHO specifically restarted or stopped SQL Services (whether it be from Configuration Manager, Services.msc or right clicking within Object Explorer inside of Management Studio).
What I mean by this is if you look in the Event Viewer for any Windows Server (2008, 08R2, 2012 or 12R2) they all seem to always show logs for the shutdown and startup events with the following data:
First a 102 Event ID shows up in the Application log which is a Service Control event for “SQLServerAgent service successfully stopped.”
Then a 101 Event ID shows up in the log for “SQLServerAgent service successfully started.”
That constitutes a cycled service. My problem seems to be that for every such event Windows NEVER reports any user other than "N/A".
Does anyone know how to obtain or log such information without guessing?