Although stopping the SEP Services does create log entries, with SMC -Stop, the logs are not uploaded until/if the service is started again. I have a customer that would really like to see the SMC -Stop process insert a segment to upload logs (including the attempt to stop SMC) prior to actually stopping SMC. This will allow visibility of a potential security risk in a timely manner rather than after the fact when the machine comes back online (if it comes back online).
Erik Goldoff