[Backport 7.81.x] Add group_per_user_services option to windows_service

[dd-octo-sts]

Backport 9212de9 from #24087.

---

What does this PR do?

Adds an opt-in group_per_user_services instance option (default false) to the windows_service check. When enabled, Windows per-user service instances — named <template>_<LUID> (e.g. OneSyncSvc_443f50) — are reported under their template name in the windows_service, display_name, and legacy service tags. Detection gates on the SERVICE_USERSERVICE_INSTANCE service-type flag plus a trailing _<LUID> suffix, so regular services are never rewritten.

Motivation

The OS derives a unique LUID for each user logon session, and that LUID is appended to every per-user service name. Because the LUID differs per host (and per session), a single per-user service like OneSyncSvc becomes a distinct windows_service tag value on every host reporting it. Across a fleet, that is up to one unique tag value per host × ~15-20 per-user services, which explodes windows_service/display_name tag cardinality in the backend — most visibly with services: [ALL]. Grouping collapses all of those into a single template-named series org-wide.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[datadog-prod-us1-5]

   

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 1 Pipeline job failed

Validate repository | Run Validations / Validate     

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 96.07%

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 779f3fd | Docs | Datadog PR Page | Give us feedback!}

[dd-octo-sts]

Validation Report

Validation	Description	Status
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	❌

Run ddev validate all changed --fix to attempt to auto-fix supported validations.

Passed validations (20)

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run