Scripting

I have the following query (riffing off of the canned k1000 report for identifying services set to auto start that are not running):

SELECT M.NAME AS 'System',

NS.DISPLAY_NAME AS 'Service Display Name',

NS.NAME AS 'Service Name',

NS.STARTUP_TYPE AS 'Startup Type',

NS.STATUS AS 'Service Status'

FROM MACHINE M

LEFT JOIN MACHINE_NTSERVICE_JT MNJT ON M.ID = MNJT.MACHINE_ID

LEFT JOIN NTSERVICE NS ON MNJT.NTSERVICE_ID = NS.ID

WHERE M.OS_NAME LIKE '%Windows%'

AND NS.STARTUP_TYPE LIKE 'SERVICE_AUTO_START'

AND NS.STATUS LIKE 'SERVICE_STOPPED'

-- AND NS.NAME = 'AVP'

AND NS.NAME = 'ntrtscan'

-- AND NS.NAME RLIKE 'AVP'|'ntrtscan'

GROUP BY M.NAME, NS.NAME

The goal is to identify all Windows machines with either one or the other service, 'ntrtscan' or 'avp', stopped.

If I use 

AND NS.NAME = 'AVP'

I get one result.

If I use 

AND NS.NAME = 'ntrtscan'

I get three results.

If I use 

AND NS.NAME RLIKE 'AVP'|'ntrtscan'

I get throusands of results when I'm expecting four.

If I use 

AND NS.NAME RLIKE 'AVP'

I get one result... What am I missing?

Thanks