The best thing to do is to setup an EAP to monitor the Event Log for when the service stops. Stop the service, then read the event log and copy the text from the Event Log. Then create a simple Event Filter for that event log. Usually it gets logged in System under "Service Control Manager". The Event ID is 7036, which is used for when all services are stopped. Configure the filter to only grab those with the text from the service you wish to monitor. This method is better than applying a Resource Monitor because it takes up less CPU usage on both the server and the client. Let me know if this works for you.