@levi: If a user has permissions to turn off/tamper with osquery, they can probably also remove the logs indicating the restart.