REVIEWED by Sophos
SELECT
os_version.name os_name,
services.name,
services.display_name,
services.start_type,
services.path,
services.status,
services.user_account
FROM services JOIN os_version
WHERE services.name = 'NTDS'
To only find machines with an old OS you could add
AND os_version.name LIKE 'Microsoft Windows Server 200%'
To find machines where the service is present but disabled you could add
AND services.start_type = 'DISABLED'
