Find Domain Controllers

 REVIEWED by Sophos 

SELECT
os_version.name os_name,
services.name,
services.display_name,
services.start_type,
services.path,
services.status,
services.user_account
FROM services JOIN os_version
WHERE services.name = 'NTDS'

To only find machines with an old OS you could add

AND os_version.name LIKE 'Microsoft Windows Server 200%'

To find machines where the service is present but disabled you could add

AND services.start_type = 'DISABLED'