[Unprivileged] Enable --unprivileged on Windows

[blakerouse]

Describe the enhancement:

Current support for --unprivileged is isolated to Linux, this needs to be expanded to support Windows.

Describe a specific use case for the enhancement or feature:

To allow Elastic Agent to run on Windows without requiring Administrator privileges.

What is the definition of done?

When install --unprivileged installs and Elastic Agent works running on Windows in this mode.

[elasticmachine]

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

[nicpenning]

Will this allow a service account or managed user to do this?

For example, if I have a service account in active dieectory that works on the system already, can I use that or is elastic creating an account and group locally?

The use case is integrations that need network access from specific service accounts in active directory to be the service context for filebeat (api, file shares, etc).

Today system is the only option but this gives me hope for 1 non system which is great, but having custom users would be excellent.

In the past you could simply install filebeat or winglogbeat with the service account you needed as a service and it would use that user context when it runs.

[cmacknz]

is elastic creating an account and group locally?

From #4264 in the initial implementation we are creating a new account unconditionally. "During installation the elastic-agent-user user and elastic-agent group is created, permissions are set correctly on the copied files, service is created running as the elastic-agent-user".

I created #4585 to track using a pre-existing account.