function Get-SamsaraServices {
    param($Result)
    Invoke-SamsaraRead $Result 'Windows services' {
        # Do not query PathName: it can include secret-bearing command arguments.
        $index = 0
        $Result.data = @(Get-CimInstance -ClassName Win32_Service -Property Name,State,StartMode,ProcessId -ErrorAction Stop | ForEach-Object {
            $index++
            [pscustomobject]@{ name = Get-SamsaraPublicName 'services' ([string]$_.Name) $index
                state = [string]$_.State; startup = [string]$_.StartMode; account = 'Omitted by privacy policy'; pid = [int]$_.ProcessId }
        })
    }
    $Result.limitations += 'All visible service states are inventoried, including running services. Executable command lines and credentials are not collected; service accounts do not prove consumers.'
}