You wish to use DCS policies to monitor the enabling and/or disabling of windows services on dcs agents
There is no direct option in the detection policy; However, windows event viewer can be leveraged to indirectly achieve this. Basically, windows events are generated during a change in windows service start / stop. Event 7036 is generated with a description, e.g.: staring and stopping the Application Information service generates the event:
The Application Information service entered the running state.
Similar events are generated for enabling or disabling an event. e.g.:
Event ID 7040 with the description:
The start type of the Print Spooler service was changed from disabled to auto start.