function Get-SamsaraServices {
    param($Result)
    Invoke-SamsaraRead $Result 'Windows services' {
        # Do not query PathName: it can include secret-bearing command arguments.
        $Result.data = @(Get-CimInstance -ClassName Win32_Service -Property Name,DisplayName,State,StartMode,StartName,ProcessId -ErrorAction Stop | ForEach-Object {
            [pscustomobject]@{ name = [string]$_.Name; display_name = [string]$_.DisplayName
                state = [string]$_.State; startup = [string]$_.StartMode; account = [string]$_.StartName; pid = [int]$_.ProcessId }
        })
    }
    $Result.limitations += 'All visible service states are inventoried, including running services. Executable command lines and credentials are not collected; service accounts do not prove consumers.'
}