This is the latest quest of the day. I am appealing to all those that have a great handle on how Windows events happen and whether or not they are kept or just logged. If you get an event in the Event Viewer that indicates that "Service Control Manager" stopped SQL Server, there is no indication of the user that did it.
Is there a way to capture that after the fact? Or in other words, does Windows store that anywhere that you can get to after it has come back up? Windows has not been restarted, but SQL Server has.
Any ideas of how to find out who stopped and started SQL Server would be great.