How to Identify Who or What is Restarting SQL services via Service Control?

I investigated an instance that experienced an unexpected restart and came across the usual service control event but no user login associated with it. Is it still possible that an authorized user initiated the restart or is this due to Windows issuing the command? If an authorized user, outside of the SQL error logs and event logs, where could I go about attempting to identify the user?

Log Name: System Source: Service Control Manager Date: 12/24/2014 9:02:24 AM Event ID: 7036 Task Category: None Level: Information Keywords: Classic User: N/A Computer: XXX Description: The SQL Server Agent (MSSQLSERVER) service entered the stopped state.