How can I find out WHO did the restarting of such service?

I fully understand that anyone with logonlocally privledges can get to and use these restarts but how do I...