I used several WMI queries in Windows8.1x64 on wbemtest.exe to attempt finding out which user started a particular service. The ones that got me "this far" are presented here. I know that if I query the win32_service object like:
select * from win32_service where name like '%SERVICENAME%'
I obtain only one result (the service I'm looking for), then I double click it to browse the service properties, and found out there's a property called "StartName" which shows the name of the user that started it (that's what I want).
Now, the problem begins when I do:
select StartName from win32_service where name like '%SERVICENAME%'
Win32_Service = <no key>
Even without the where clause it shows the same. (But for all local services)
What am I missing to make it work properly?