REVIEWED by Sophos
SELECT os_version.name os_name, services.name, services.display_name, services.start_type, services.path, services.status, services.user_account FROM services JOIN os_versionWHERE services.name = 'NTDS'
To only find machines with an old OS you could add
AND os_version.name LIKE 'Microsoft Windows Server 200%'
To find machines where the service is present but disabled you could add
AND services.start_type = 'DISABLED'