It looks like that the proper answer is using a "preset" file: http://freedesktop.org/wiki/Software/systemd/Preset/

This answers at least how to not enable services by default. But it doesn't answer how to not start any service in "forensic" mode. This is probably implemented with a different "target" at boot time.

Unfortunately, it looks like we can't use Preset file in Debian currently. I just filed a bug about this: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=772555

It looks like most of the services are still properly disabled thanks to some systemd/update-rc.d integration. But there are corner cases when the packages ships a .service file that does not have the same name as the init script.

I just filed http://bugs.debian.org/781155 on openbsd-inetd for example. And also the update-rc.d integration with systemd is somewhat problematic: http://bugs.debian.org/746580

Hi there and apologies for slight off-topic, just mentioning:

In case you do experience too many problems with the systemd switch of Debian, we have arms open over at Devuan with a beta release approaching and a complete CI that is building packages for all original targets, see http://devuan.org

Even just an experimental branch of Kali 2.0 based on Devuan would be easy to do and may provide a better experience for both users and developers.

Jaromil, in fact the switch has been rather smooth for us and we look forward to taking advantages of systemd's feature set!

This issue should be fixed with init-system-helpers_1.28+kali3.dsc and base-files 2016.2.0.

base-files provides systemctl preset files and init-system-helpers has been modified so that "deb-systemd-helper enable" calls "systemctl preset" instead of doing the work itself.