What's the best way to track Updated By, Updated On
1) Your trigger idea is good: we use it sometimes.

It is foolproof mostly except:


issues you mentioned
you don't always have SUSER_SNAME if folk connect via a web server or middle tier


You can mitigate this with SET CONTEXT_INFO to control admin behaviour, or more carefully to pass in some end user details.

2) All writes via stored procedures. We use this method mostly. 

We also use defaults on UpdatedOn so...

UPDATE
   ...
   UpdatedBy = whoever, UpdatedOn = DEFAULT


3) Let your client do it. I won't take this any further...

Finally, we implemented "AffectedBy", and "AffectedOn" fields to track admin/indirect updates.