How do I tell who stopped a service

I need to find out what user is stopping a service on one of our servers. I am fairly certain who it is as I see them log into terminal services just moments before it happens. But I need something that actually links his user name to the stopping and starting of services

Thanks in advance