how ntservice probe collects the monitoring data on windows servers?
The ntservices probe monitors the NT services available on the Windows system where the probe is deployed.
The probe uses Remote Procedure Calls (RPC) to detect which services are running.
For example please see dwCurrentState in link below.
There is a mapping table where the value received from the OS is mapped to a particular value stored inside ntservices probe which is further used as per the design of the probe.