Audit OSQL command shutting down a SQL Server I need to determine when, and by whom, a SQL Server was shutdown using the osql command. The osql command takes user name and password input. Are there any specific Windows Event logs generated to identify the user, time etc.?
As mentioned by Dan Guzman if you are using the T-SQL SHUTDOWN command to shut down SQL Server, you see see the details with username in two places:

SQL Server Error Log


  Date      3/15/2020 7:44:16 PM Log        SQL Server (Archive #1 - 3/15/2020
  7:44:00 PM)
  
  Source        spid67
  
  Message Server shut down by NOWAIT request from login
  domaninName\Username.


Windows Event Log


  Event Id: 6006
  
  Server shut down by NOWAIT request from login domaninName\Username.




If you are stopping SQL Server from configuration manager, services in the control panel or command prompt, you will only get the stop time but not the user who initiated the stop command.