NSClient++: baixar versions anteriors

# The agent reports configuration it ignores, and a robustness pass over scripting and concurrency

0.25.0 makes misconfiguration visible: a section or key nothing reads is now logged, shown in the web UI and reported by `nscp settings --validate`. Collector-backed checks gain a `warmup-state` option, `kill tree` finally works on Linux, and the rest of the release is the harvest of a stress harness, a concurrency audit and a full test of the Lua and Python APIs: a Lua crash under concurrent calls, socket requests stuck behind unrelated slow checks, duplicated events and client payloads, and a long list of smaller fixes.

## ✨ Highlights

- 🔍 **Configuration nothing reads is reported.** A misspelled section, a section without its leading `/`, or a key above the first section used to be ignored without a word. The agent now warns about each one at startup and on every reload, the web UI shows a *Configuration problems* banner, and `nscp settings --validate` exits with `1` when it finds any (#647, #1657).
- ⏱️ **`warmup-state` for collector-backed checks.** `check_cpu`, `check_load` and, on Linux and macOS, `check_memory`, `check_pagefile` and `check_network` can report `ok` (or any other status) instead of UNKNOWN while the collector takes its first sample, so a restart need not raise alerts. A collector that is disabled or failing now says so instead of reporting zeros (#1621).
- 🐧 **`kill tree` works on Linux.** The script runs in a session of its own and a timeout signals the whole process group, so backgrounded helpers die with it; unloading CheckExternalScripts now ends running scripts (#1629).
- 🔒 **Lua and Python scripting hardened.** A Lua check running twice at once could crash the agent; listing scripts over REST ran every check; and a test of every documented API fixed a dozen bindings that did nothing or crashed (#1642, #1636, #1632).
- 📡 **Socket servers no longer queue behind slow checks.** About one NRPE, NSCA, check_mk or NSClient request in a few hundred waited for an unrelated long-running check, which showed up as an occasional `Socket timeout` (#1642).
- 🔒 **OpenSSL 3.5.9** in the Windows builds, from the 29 September 2026 upstream security release (#1666).

## ⚠️ Upgrade notes

The full list is on the [upgrading page](https://nsclient.org/docs/setup/upgrading/), and the security fixes on the
[security notices page](https://nsclient.org/docs/security/notices/).

- **`nscp settings --validate` can now exit with `1`.** A script or pipeline that runs it fails on any unread section or key; fix the reported entries.
- **Fleet host overrides now win over bundles.** If a host override sets a key a bundle also sets, the host switches to the override's value; check your overrides if you relied on the bundle winning.
- **Aliases containing `\n` are refused.** Check the log for `Refusing alias` after upgrading; write `\\n` for a literal, and Windows paths with `/` or doubled backslashes.
- **Log-matching rules.** The *rejected connection* lines (now one line), check_nt's *No performance data* error and `check_pdh`'s `Failed to add counter` text changed; match the new prefixes.
- **LUAScript reloads re-run `on_start`**, and Lua `require()` / CheckMKClient scripts resolve from `${scripts}`; check scripts that must run once, or helpers kept under the install base with a custom `${scripts}`.
- **PythonScript** passes `python` as `plugin_alias` and `Core.simple_exec` reports failures as UNKNOWN; check scripts that test for `""`, `0` or `False`.
- **Linux `kill tree = true`** now runs the script in its own session; a script that calls `setsid()` itself gets `EPERM`.
- **Permission policy:** a reload that fails part-way now denies exec until a later reload succeeds. Nothing changes unless `[/settings/permissions] enabled = true`.

**Full Changelog**: https://github.com/mickem/nscp/compare/0.24.1...0.25.0

# NSCANgClient leaves the Windows installer after antivirus detections

0.24.1 is a small follow-up to 0.24.0 with one change: the Windows installer
no longer ships `NSCANgClient`, because a few antivirus engines report its DLL
as malware and made the whole MSI look infected. The module is still in the
Windows zip, still signed, and is copied into place by hand.

This release is **only a workaround** for what are most likely false positives,
not a fix: the module's code is the same as in 0.24.0, and nothing else
changed. **If you use `NSCANgClient` on Windows, stay on (or install) the
0.24.0 build instead**, which still ships the module in the installer.

## ✨ Highlights

- ⚠️ **Only a workaround: `NSCANgClient` users should use 0.24.0.** 0.24.1
changes nothing but the packaging of this one module. If you submit results
over NSCA-NG from Windows, the 0.24.0 installer gives you the same module
without the manual copy.

- 📦 **`NSCANgClient` is no longer in the Windows MSI.** Four antivirus engines
on VirusTotal flag `NSCANgClient.dll` from 0.24.0 with generic
machine-learning verdicts. Until the vendors have analysed it, the module
ships in the Windows zip only. Linux and macOS packages are unchanged. (#1615)
- 🔒 **A security notice on what the detections do and do not mean.** The
verdicts are likely false positives but unconfirmed, and the release's
signature, attestation and checksums show the file was not altered after the
build, not that the build itself was clean. The notice and FAQ 1.12 spell out
both.
- 🪟 **The DLL stays signed in the zip.** The signing list is read from the
installer sources, so leaving the module out of the MSI would have dropped it
from signing too; it is now kept on the list explicitly.

## ⚠️ Upgrade notes

- **Windows, `NSCANgClient` users: use 0.24.0 instead.** 0.24.1 is only a
workaround for the antivirus detections and has nothing else in it, so
staying on 0.24.0 keeps the module installed and managed by the MSI. If you
upgrade anyway: an MSI upgrade removes the copy an earlier
installer put there, and the service then logs that the module was not found.
Copy `modules\NSCANgClient.dll` from the matching zip into the `modules`
folder after upgrading, and again after every later upgrade: the installer
does not own a file copied this way, so it never replaces it. Check the file
first as FAQ 1.12 shows. Nothing to do if you do not use NSCA-NG on Windows,
or on Linux and macOS.

**Full Changelog**: https://github.com/mickem/nscp/compare/0.24.0...0.24.1

# Host facts, NSClient++ on macOS, and new checks from Active Directory to Kubernetes

0.24.0 is a big release, and most of it is about the agent knowing more: what the host it runs on actually is, and what the services on it are doing.

The headline is **host facts** — an opt-in inventory the agent keeps about its host. The OS and hardware, network interfaces, volumes, installed software, services, scheduled tasks, Docker, MySQL, SQL Server and Hyper-V each become a fact set you turn on in the module that already checks that thing. The collected document is served over REST behind two new grants, shown on a new *Facts* page in the web UI, readable from a remote agent with `check_nsclient nsclient facts show`, and uploaded to the fleet server by an enrolled agent — as a hash on every poll, and as the document only when the server says it holds a different one. Every set is off until you enable it.

Alongside that, NSClient++ runs on **macOS** for the first time (an experimental Apple silicon package, with `CheckSystem` ported to Darwin), and there is a wave of new, experimental checks: Active Directory, Hyper-V, Kubernetes, Windows Failover Clusters, NPS and RADIUS, domain registration expiry, and eight more SQL Server checks.

The hardening pass continues. One request can no longer cost the agent without bound — command nesting, `check_multi` fan-out, regular-expression matching and log-file reads all have limits now. The shared default password is stored hashed, `nscp web install` sets up HTTPS on its own, a module can only be named by a file name, the Linux service runs sandboxed under its own group, every DLL the Windows installer ships is signed, and a failing background thread can no longer take the whole agent down. Several of these have an upgrade note worth reading — `NSCAServer` users in particular.

## ✨ Highlights

- 🏷️ **Host facts: an opt-in inventory of the host.** `os`, `hardware`, `network.interfaces`, `storage.volumes`, `software.installed`, `services.installed`, `tasks.scheduled`, `agent`, `docker`, `mysql`, `mssql` and `hyperv.vms` sets, each produced by the module that already checks it and each off until enabled. CheckSystem also publishes three new selector tags — `os_family`, `arch` and `virtualization` — that mean the same thing on every platform. (#1559, #1583, #1589, #1594)
- 📤 **Facts over REST, in the web UI and on the fleet server.** `GET /api/v2/facts` and `POST /api/v2/facts/commands/refresh` sit behind the new `facts.get` and `facts.refresh` grants, which only the `full` role carries. An enrolled agent uploads its document only when the server's hash differs. (#1559, #1590)
- 🍎 **NSClient++ on macOS.** An experimental, self-contained Apple silicon `.pkg` and `.tar.gz`, running as a launchd daemon. `CheckSystem` carries all 21 of its Linux commands on macOS, with `check_service` checking launchd jobs. The package is not signed or notarized yet. (#1578, #1593)
- 🧪 **New experimental modules: `CheckActiveDirectory`, `CheckHyperV` and `CheckKubernetes`.** AD replication, the machine secure channel and a real Kerberos probe of each KDC; Hyper-V host capacity, hypervisor CPU and per-VM health; and a Kubernetes cluster's API, pods, nodes and workloads, read over HTTPS with a service-account token and no `kubectl`. (#1601, #1586, #1587)
- 🪟 **More Windows server checks.** Failover Cluster groups, resources, nodes and networks that follow a role across nodes; NPS authentication, accounting and counters; and eight new SQL Server checks — availability groups, blocking, counters, integrity, sessions, tempdb, transactions and waits. (#1600, #1598, #1398)
- 🌐 **`check_domain` and `check_radius` in CheckNet.** Domain registration expiry over RDAP with an optional WHOIS fallback, and an authenticated RADIUS probe that validates the response authenticator and reads its credentials from a protected file. (#1599, #1598)
- 🛡️ **Bounded work per request.** A deeply nested `check_multi` could exhaust a thread

# Metrics a scraper can actually read, Mod-Gearman, and a much smaller install

0.22.0 rebuilds the metrics side of the agent. `/api/v2/openmetrics` served the
JSON keys verbatim — names with dots, spaces and colons in them, no types, no
help text, six significant digits — which a strict parser rejected outright.
It now serves a conformant, self-describing OpenMetrics document: every family
named to the grammar, typed, described, carrying its unit, and per-instance
readings collapsed into one family with a `core`, `nic` or `drive` label
instead of one family per core. Every metric name changes, so read the upgrade
note before you upgrade a scraped host.

The second theme is a new transport. `GearmanClient` makes the agent a
Mod-Gearman worker: a Naemon or Nagios Core keeps scheduling its checks, the
agent pulls them off a `gearmand` job server and answers them as native
queries, and the monitored host needs no inbound port at all. The same module
submits passive results back into the core's result queue. It ships marked
**experimental** and has not been exercised at scale: it is verified end to end
against a real job server on both cores, but no one has yet run it across a
large estate, so put it on a slice of your hosts before you move a whole
Mod-Gearman installation onto it.

Then a long tail of security work — the low-severity tier of the audit, in
three parts, plus a second undefined-behaviour sweep and the ten worst
threading bugs — and a packaging release: common code moved out of every
plugin into shared libraries, Windows ARM64 is back, and there is a Raspberry
Pi package.

## ✨ Highlights

- 📊 **A conformant OpenMetrics exposition, and every metric name changes.**
Names follow the grammar (`system.cpu.core 0.idle` →
`system_cpu_idle_percent{core="0"}`), every family carries `# TYPE`, `# HELP`
and a `# UNIT` where the value is measured in something, counters are typed
as counters, string readings come back as `_info` families, values keep their
full precision and the body ends with `# EOF`. Per-core, per-NIC, per-drive
and per-process readings become one family with a label, so `sum by (core)`
has something to group on. The JSON endpoints, the dashboard, Graphite,
collectd and Python `submit_metrics` report the same keys and values as
before. `openmetrics format = legacy` reproduces the old body as a migration
window. (#1533, #1535, #1538, #1539)
- 📥 **New module: `GearmanClient`, a Mod-Gearman worker and result channel.**
Optional, off by default, and it speaks both flavours — ConSol's Mod-Gearman
for Naemon and Nagios Enterprises' Nagios-Mod-Gearman for Nagios Core 4.5+.
`mode = agent` answers for the host it runs on; `mode = proxy` runs a whole
hostgroup's checks from one box. Windows and Linux. **Experimental and not
yet tested at scale** — try it on a few hosts first. (#1542)
- 🔒 **A settings source, include or attachment that is not `https://` is
refused.** The remote store is the agent's whole configuration, re-read at
boot and on every housekeeping pass, and over plain `http://` nothing
authenticates the server. Opt back in per host with `allow plaintext = true`
in `boot.ini`; every plaintext fetch is then logged as `INSECURE`. (#1529)
- 🛡️ **The audit's low-severity tier lands, in three parts.** A request may no
longer weaken a credentialed target's transport security or re-address
`submit_smtp` mail; script arguments, `check_docker`'s endpoint and the
remote-connection checks are confined; and the web server sends browser
hardening headers, negotiates TLS 1.3 on Linux and stops minting a session
token per request. (#1550, #1551, #1552)
- 🔑 **`check_tcp` and `check_ssh` verify the server certificate by default.**
`verify` defaulted to `none`, so a TLS check handshook against any
certificate at all and reported `ok`. It now defaults to `peer` with `ca=`
falling back to the agent's own trust bundle, and the checks gained
certificate identity, SAN and STARTTLS-service keywords. (#1547)
- 🔁 **Agent-to-agent

# NSClient Fleet launches：central management for your agents, plus checks that only read what you allow

0.21.0 is the agent release that goes with the first release of **NSClient
Fleet**, a new, separate product：one server that holds the configuration for
a whole estate of NSClient++ agents, hands each host the part that applies to
it, and shows you what every host is actually running. Agents enroll
themselves and report what they are, so the server builds the inventory
instead of consuming one; groups select hosts by those reported tags, and
bundles of configuration and scripts attach to groups. This release brings
the agent side to feature parity with the server：encrypted bundles the server
cannot read, a way to leave a fleet, and an `nscp test` prompt that survives a
configuration push. Fleet is entirely optional; NSClient++ works exactly as it
always has without it.

The other theme is reading less. `check_logfile`, `check_files`, `check_wmi`,
`check_pdh`, `check_registry_*` and `check_eventlog` read whatever their
argument names, with the agent's privileges, which is a general read primitive
wherever a caller may choose the argument. Each of them now has an access mode
and an allow list, off by default. Two WEB roles complete the picture:
`restricted` runs the checks you define but passes no arguments, and
`metrics` scrapes and does nothing else. And the `nscp test` prompt got a
round of usability work：aligned listings, a `desc` that shows defaults and
what an alias runs, filter keyword lists, single-quoted paths and
case-insensitive completion.

## ✨ Highlights

• 🚀 **NSClient Fleet is out.** A server that enrolls your agents, builds the
inventory from what they report, and delivers configuration and scripts per
host as signed bundles, pulled by the agent over mTLS with no inbound port.
Read the [launch announcement](https://nsclient.org/news/2026/09/14/nsclient-fleet/)
and the [Fleet documentation](https://nsclient.org/docs/fleet/); this
release is the agent side of it.
• 🛡️ **Access modes for the checks whose argument decides what is read.**
`check_logfile`, `check_files`, `check_single_file`, `check_disk_write`,
`check_wmi`, `check_pdh`, `check_registry_key`, `check_registry_value` and
`check_eventlog` each gained a mode setting and an allow list. The default,
`any`, is exactly the previous behaviour; `predefined` limits a caller to the
names you configured; `allowed` matches an allow list. Nothing changes on
upgrade. (#1516)
• 🔒 **Two WEB roles that cannot be widened.** `restricted` holds
`queries.execute.noargs`, the REST equivalent of NRPE's
`allow arguments = false`：it runs the checks the agent defines and refuses
any query-string parameter. `metrics` reads the two metrics endpoints and
nothing else. The bundled `monitoring` role finally holds the grant the
metrics endpoints actually check, so a monitoring user is no longer answered
403 there. (#1517, #1520)
• 🔐 **Encrypted fleet bundles.** A bundle sealed in the fleet server's browser
is opened by the agent with a key you hand it out of band, at enrollment
(`nscp enroll --bundle-key`, `FLEET_BUNDLE_KEY` on the MSI) or later. The key
and the optional "sealed bundles only" posture live in the enrollment
manifest, never in the settings store, so the server cannot plant or switch
them. (#1521)
• 🚪 **`nscp enroll --unenroll` leaves the fleet.** It removes the include,
the identity and keys, and the fleet directory, and reports each step.
(#1521)
• 💥 **`nscp test` no longer crashes after a fleet configuration push.** A
settings reload replaced the object the prompt's completion held a pointer
to; the next completion refresh dereferenced freed memory. The crash file the
agent writes now names the faulting module instead of printing a pointer.
(#1521)
• 🖥️ **A better `nscp test` prompt.** Padded tables instead of tabs in every
listing, `desc` with parameter defaults, the bare-call command line and what
an alias runs, a `keywords` verb listing a check's filter key

# Security hardening and bugfixes of monitoring clients

0.18.1 is a security and correctness release for the passive/outbound side of
the agent. A review pass over the client modules — Icinga, NRDP, NSCA, NSCA-NG,
check_mk, Elastic, Graphite, syslog, and a second round on SMTP — turned up the
same three shapes over and over：**configuration that parsed fine and was then
thrown away**, **network operations that could never time out**, and
**attacker-influenced text reaching another system's log unscrubbed**. The
external-script launcher and the filter framework got the same treatment.

The most consequential single item is NSCA-NG cert mode, which applied its TLS
configuration too late and therefore accepted any server certificate. Alongside
the hardening, the Elastic module can finally talk to a current Elasticsearch,
the web UI moves to MUI 9 / react-router 8 with its test suites wired into CI,
and a coverage sweep adds unit tests to every source file that was under 50%.

## ✨ Highlights

• 🔐 **NSCA-NG cert mode verifies the server again — and presents your client
certificate.** The OpenSSL context was configured *after* the TLS stream was
created from it, and `SSL_new()` copies the verify mode, certificate, cipher
list and version bounds at creation time. So `verify mode = peer-cert` ran
with verification off, any certificate was accepted, and the configured client
certificate was never sent. The default PSK mode was never affected. (#1461)
• 🧾 **Configuration that silently did nothing now applies.** check_mk client
targets discarded every TLS key (`use ssl`, `certificate`, `verify mode`, …)
and connected in plaintext regardless; syslog targets never read `severity`,
`facility`, `tag_syntax` or `message_syntax`; `NSCAServer`'s
`performance data = false` was ignored; and `ext-scr install --arguments=…`
wrote its lockdown to a key the module does not read. All four are fixed.
• ⏱️ **A stalled endpoint can no longer wedge a submitting thread forever.**
Icinga, NRDP, Graphite and Elastic submissions all ran with no deadline; each
is now bounded by the target's `timeout` (default 30 s) as a single budget
over resolve, connect, handshake and exchange. External scripts enforce their
`timeout` by wall clock on both platforms. (#1464, #1465, #1466, #1467, #1468,
#1453)
• 🔎 **The Elastic module works against Elasticsearch 8 — and verifies TLS.**
Verification was hardcoded off; it now defaults to `peer` with `tls version`,
`verify mode` and `ca` settings, plus new `user`/`password` and `api key`
authentication. The legacy `_type` parameter is no longer sent by default, and
every document in a bulk request gets its own `_id` — previously they shared
one and overwrote each other. (#1453)
• 🔒 **`tls version = 1.2+` means "1.2 or later" again.** The `+` was stripped
and the value mapped onto a version-pinned method, which pins the *maximum*
too — so the common default negotiated TLS 1.2 only and silently excluded
TLS 1.3. Fixed in the shared stack：all HTTP-based clients, the NRPE/NSCA
socket clients and servers, and `check_tcp`. (#1464)
• 📨 **Syslog datagrams carry the RFC 3164 HOSTNAME field**, so a conforming
receiver stops promoting the tag to origin host — which meant check output
could choose which host a record was filed under. An unknown `severity` or
`facility` now degrades to `<13>` (user.notice) instead of `<0>`,
kernel.**emergency**. (#1470)
• 🧱 **Filter expressions are bounded** at 1024 characters and 64 nesting levels.
The parser and the AST evaluator both recurse with the shape of the input, so
a long or deeply nested expression could exhaust the stack and crash the
agent. Real filters sit an order of magnitude below the limits. (#1469)
• 🖥️ **The web UI moves to MUI 9, react-router 8 and TypeScript 6**, with its 65
vitest unit tests and 18 Playwright integration tests now running in CI on
every build. (#1459)

## 🔍 Detailed changes

### 🔐 NSCA-NG — cert mode applies TLS configuration before the stream exists

`use p

# Security release：request-smuggling fixes in the bundled web server

This release upgrades the Cesanta Mongoose web server bundled in the Windows builds to 7.23, closing two critical HTTP request-smuggling vulnerabilities in its HTTP parser. If NSClient++'s web server is reachable through a reverse proxy or WAF, upgrade promptly.

## Highlights
• **Bundled Mongoose upgraded from 7.20 to 7.23.** Fixes two critical (CVSS 9.1) HTTP request-smuggling vulnerabilities, [CVE-2026-73256](https://nvd.nist.gov/vuln/detail/CVE-2026-73256) and [CVE-2026-73257](https://nvd.nist.gov/vuln/detail/CVE-2026-73257), fixed upstream in Mongoose 7.22.
• **Windows builds only.** The Windows `WEBServer` module (REST API and web UI) uses the Mongoose backend; the Linux DEB/RPM packages build on Boost.Beast and never contained the vulnerable code.
• **Exploitable behind an intermediary.** Both flaws let an unauthenticated attacker smuggle requests past a reverse proxy, WAF or load balancer in front of NSClient++ — bypassing proxy-level ACLs or injecting into other clients' reused connections. Direct client → NSClient++ deployments have no front end to desynchronize, and NSClient++'s own authentication is still enforced per request either way.

## Detailed changes

### WEBServer — bundled Mongoose upgraded to 7.23 (security)

Mongoose versions before 7.22 mis-parse HTTP message framing in two ways:

| CVE | Flaw |
|---|---|
| [CVE-2026-73256](https://nvd.nist.gov/vuln/detail/CVE-2026-73256) | Broken HTTP/1.0 detection in `http_cb()` — a request combining `Transfer-Encoding：chunked` with conflicting HTTP/1.0 framing is parsed with different message boundaries than an HTTP/1.0 reverse proxy sees. |
| [CVE-2026-73257](https://nvd.nist.gov/vuln/detail/CVE-2026-73257) | Requests carrying **both** `Content-Length` and `Transfer-Encoding：chunked` are accepted instead of rejected, enabling CL.TE desynchronization against a Content-Length-preferring front end. |

All build pipelines now pin Mongoose 7.23 (the latest release, which also carries further upstream TLS and TCP/IP hardening)：the Windows CI workflows, the Linux docker scenario images that fall back to the Mongoose backend (`minimal`, `no-openssl`), and the developer build instructions. The full advisory record is on the [security notices](https://docs.nsclient.org/security/notices/) page.

## Upgrade notes
• **Upgrade Windows installs, promptly if behind a reverse proxy/WAF:** the request-smuggling CVEs only matter when an intermediary in front of NSClient++ frames the HTTP stream differently than the built-in web server. No configuration change is needed — this is a drop-in upgrade.
• **Linux packages are unaffected** (Boost.Beast web backend, no Mongoose), as are installs with the `WEBServer` module disabled.

**Full Changelog**：https://github.com/mickem/nscp/compare/0.16.3...0.16.4

Host security posture, JSON-aware HTTP checks, and a clearer licence
This release adds a brand-new CheckSecurity module for monitoring a host's
security posture — certificates, firewall, antivirus, BitLocker, Secure Boot,
NLA and logged-on users — and teaches check_http to assert on values inside a
JSON response body. It also fixes boolean check arguments over REST, tidies up
process aggregation and module activation, relicenses the project under a clear
dual licence, and reworks the documentation to handle Windows and Linux side by
side.
Highlights
- New CheckSecurity module. Seven new checks for host security posture:
check_certificate, check_firewall, check_antivirus, check_bitlocker,
check_secureboot, check_nla and check_users. check_certificate and
check_users run everywhere; the rest are Windows-only. (#1339)
- check_http can assert on JSON responses. New json-path=alias:path
options extract values from a JSON body into filter keywords you can threshold
on and emit as perfdata. (#1341)
- CheckNet queries now emit performance data by default, so check_http,
check_tcp and friends graph out of the box without an explicit perf
syntax. (#1341)
- Boolean check arguments accept values, not just flags.
check_ping host=www.google.com total=true now works alongside the bare-flag
form — the form REST already used. (#1338)
- Activate several modules in one command:
nscp settings --active-module CheckSystem CheckNet. (#1329-follow-up)
- Clear dual licence. NSClient++ is now Apache-2.0 OR GPL-2.0-only, with
machine-readable REUSE metadata and third-party notices. (#1343)
- Reworked, multi-OS documentation that presents Windows and Linux options
and features together instead of assuming one platform. (#1342)
Detailed changes
CheckSecurity — new host security-posture module
A new module, CheckSecurity (alias security), checks whether a host is in
the security state you expect. Each check is a normal modern_filter check, so
you can override the default warn/crit expressions, filter, and
detail-syntax/top-syntax as usual.
Command Platforms What it checks
check_certificate All X.509 certificate expiry / validity / hygiene from files or the Windows store
check_users Windows + Linux Count and detail of logged-on / RDP sessions
check_firewall Windows only Firewall profile (Domain/Private/Public) enabled and active state
check_antivirus Windows only Registered antivirus products' enabled / up-to-date state (Security Center)
check_bitlocker Windows only BitLocker drive-encryption protection status per volume
check_secureboot Windows only Whether UEFI Secure Boot is enabled (distinguishes "disabled" from "legacy")
check_nla Windows only Network Location Awareness category (public/private/domain) per network
check_certificate defaults to warning when a certificate expires within 30
days and critical within 10 (matching common practice), emits expires_in (whole
days until expiry) as perfdata, and can scan a whole directory:
check_certificate file=/etc/ssl/certs/mysite.pem
check_certificate file=/etc/ssl/certs recursive=true "detail-syntax=${subject}: ${expires_in}d"
check_certificate file=/etc/pki/tls/certs critical=expired=1
The Windows checks expose the raw state fields so you can tighten or relax the
default posture. check_firewall adds an active flag (which profile is
currently in effect) alongside enabled, so you can warn when a machine silently
falls back to the Public profile after a network change:
check_firewall "warn=active = 1 and profile = 'Public'" "detail-syntax=${profile} profile is active"
check_secureboot "warn=supported = 0" "crit=supported = 1 and enabled = 0"
check_nla "crit=connected = 1 and category != 'domain'" "detail-syntax=${network}=${category}"
On a platform where a Windows-only check does not apply, the check returns
UNKNOWN with a clear message rather than failing.
CheckNet — check_http JSON path extraction
check_http can now pull values out of a JSON response body and treat them as
filter keywords. Each json-path=ali

0.12.4 — Regression fixes for Icinga and CheckSystem
This is a maintenance release focused on regressions introduced since 0.12.3.
No new features; no breaking changes for configurations that don't hit the items below.
Highlights
- Icinga check_nscp_api works again. The query-string credential path was removed in 0.12.3 for security (commit
340b8db1). That hardening broke Icinga's bundled check_nscp_api plugin, which still passes the password as
?password=.... This release reinstates the legacy path behind a User-Agent allowlist (default: clients whose
User-Agent matches Icinga/check_nscp_api) — every other client keeps the strict post-340b8db1 rejection.
- Better "module not found" messages on Windows. When a configured module fails to load, the error now points at the
WiX installer feature that ships the module (e.g. NRPEServer → "NRPE Support"), so operators
can fix the cause (re-run the installer and tick that feature) without reading source.
- IcingaClient.dll is now in the installer. The DLL was being built but not packaged, so the corresponding
Op5/Icinga client features were unusable on stock Windows installs.
- os_updates.status keyword renamed to update_status. The previous name clashed with the built-in status
keyword every check exposes, which made filter / detail-syntax expressions ambiguous on check_os_updates. Any custom
config that referenced os_updates.status must be updated — see Behaviour change below.
- check_wmi no longer crashes on warn/crit filters. A use-after-mutation in the WMI row iterator caused an access
violation whenever a warn= or crit= filter touched a column value (e.g.
check_wmi "query=Select Version from win32_OperatingSystem" "warn=Version not like '6.3'"). Affected every
filter that exercised the post-iteration deferred-evaluation path.
Detailed changes
WebServer — legacy query-string authentication restored for specific clients (94b2057d)
The 0.12.3 hardening removed three paths because URL-borne credentials and tokens leak into browser history, proxy logs,
and Referer headers:
- GET/POST /auth/token?password=...
- GET/POST /auth/logout?token=...
- ?TOKEN=... / ?__TOKEN=... as a session-token fallback on any endpoint
Removing them broke Icinga's bundled check_nscp_api plugin, which still ships with the query-string mechanism. To
unblock that integration without re-opening the vector to browsers and arbitrary scrapers, this release gates the legacy
paths on a User-Agent allowlist:
- New setting [/settings/WEB/server] legacy query auth user agents. Comma-separated list of User-Agent substrings (
case-insensitive). A request whose User-Agent contains any pattern is allowed to use the legacy query-string
mechanism; everything else still gets the 0.12.3 rejection (410 Gone on /auth/*, 403 on ?TOKEN=).
- Default: Icinga/check_nscp_api — anchors on the specific plugin name, so unrelated tooling that merely mentions "
Icinga" in its User-Agent doesn't slip through.
- Set to an empty string to disable the fallback entirely (matches the strict 0.12.3 behaviour).
- The 410 / 403 rejection log lines now mention this setting as the escape hatch so operators don't have to dig through
source to find it.
Security posture, in short: this is not a defence against malicious clients — an attacker can spoof the User-Agent — but
it keeps the legacy vector off the default surface for browsers, scrapers, and anything else that isn't
check_nscp_api.
Service — installer-feature hints in module-load errors (793c3ee1)
When a referenced module's DLL isn't on disk (typically because the operator didn't tick the relevant feature in the
Windows installer), the error now ends with a hint:
Failed to load NRPEServer: <reason> (module 'NRPEServer' is part of the 'NRPE Support' installer feature; re-run the
NSClient++ installer and enable that feature, or see installers/installer-NSCP/Product.wxs for the full feature map)
Covers every module shipped by the MSI: CheckPlugins (the bulk of check_* modules), NRPE Support, Check 

What's Changed
CheckEventLog
- New opcode filter keyword. You can now filter Windows event log
entries on the event opcode, in addition to the existing fields
(e.g. filter=opcode = 'Info').
- Filter expressions: regex and in operators now work with numbers.
Numeric fields such as id, level, task, etc. can now be matched
using regular expressions and the in (...) operator, not just string
fields.
- Fixed scan-range. The scan-range option in
check_eventlog now correctly limits the scanned time window again.
- Fixed event ID matching issue. Event IDs are now interpreted and
compared correctly in filter expressions; previous releases could
mismatch certain IDs.
- Eventlog integration tests are run again as part of the acceptance test suite.
Linux / ARM packages
- New ARM64 (aarch64) builds and release artifacts are now produced
for Linux:
- Ubuntu 24.04: NSCP-<ver>-ubuntu-24.04-arm64.deb and
check_nsclient-<ver>-ubuntu-24.04-arm64
- Rocky Linux 9 and 10: NSCP-<ver>-rocky-9-aarch64.rpm,
NSCP-<ver>-rocky-10-aarch64.rpm and matching check_nsclient
binaries.
Full Changelog: https://github.com/mickem/nscp/compare/0.11.29...0.11.30

What's Changed
New checks:
This release adds three new checks.
check_battery
Monitor battery status on Windows laptops and mobile devices. This command provides comprehensive battery health and status information using both the Windows Power API and WMI.
- Charge Level Monitoring: Track battery charge percentage with warning/critical thresholds
- Power Source Detection: Determine if system is running on AC or battery power
- Battery Health: Calculate battery health as a percentage of design capacity
- Status Tracking: Monitor charging, discharging, critical, low, and high states
- Time Remaining: Estimate remaining battery life when on battery power
- Detailed Metrics: Access charge/discharge rates and capacity information via WMI
Basic battery check with default thresholds (warn < 20%, crit < 10%):
check_battery
OK: system: 85% (ac, charging)
Check if battery charge is above 50%:
check_battery "warn=charge < 50" "crit=charge < 25"
OK: system: 85% (ac, charging)
Alert if running on battery power:
check_battery "warn=power_source = 'battery'"
WARNING: system: 72% (battery, discharging)
Show detailed battery information:
check_battery "detail-syntax=${name}: ${charge}% (${power_source}, ${status}, health: ${health}%, time: ${time_remaining}s)"
OK: system: 85% (ac, charging, health: 95%, time: -1s)
check_process_history
Track all processes that have been seen running since NSClient++ started. This command maintains a history of process executions, allowing you to verify that certain processes have (or haven't) run.
- Process Tracking: Records every unique process seen since service start
- Execution Counting: Tracks how many times each process has started
- Timestamp Recording: Records first and last seen timestamps
- Current State: Shows whether each process is currently running
- Selective Filtering: Check specific processes by name
Use Cases
- Compliance Monitoring: Verify that backup software, antivirus scanners, or other required applications have run
- Security Auditing: Detect if unauthorized applications have been executed
- SLA Verification: Confirm that scheduled maintenance tasks have executed
As checking processes is expensive it is disabled by default.
You need to enable it by setting:
[/settings/system/windows]
process history=true
List all processes in history:
Check if a specific backup application has run:
check_process_history --process backup.exe "warn=times_seen = 0" "crit=times_seen = 0"
CRITICAL: backup.exe (false) - never seen running
Check if a process is currently running:
check_process_history --process important-service.exe "crit=running = 'false'"
CRITICAL: important-service.exe (false) - not currently running
Alert if a forbidden application has ever run:
check_process_history --process forbidden-game.exe "warn=times_seen > 0"
WARNING: forbidden-game.exe (seen 3 times, not running)
Show detailed history for a process:
check_process_history --process notepad.exe "detail-syntax=${exe}: first=${first_seen}, last=${last_seen}, count=${times_seen}, running=${running}"
OK: notepad.exe: first=2026-04-06 08:15:32, last=2026-04-06 14:22:45, count=5, running=false
check_process_history_new
Detect processes that have been started recently within a configurable time window. This is useful for security monitoring to detect unexpected process launches.
- Time-Based Detection: Find processes first seen within a configurable window
- Flexible Time Windows: Support for seconds (s), minutes (m), hours (h)
- Security Focused: Ideal for detecting new/unexpected process launches
Use Cases
- Security Monitoring: Detect newly launched processes that might indicate compromise
- Change Detection: Monitor for new software installations or unauthorized programs
- Incident Response: Identify what processes started around the time of an incident
As checking processes is expensive it is disabled by default.
You need to enable it by setting:
[/settings/system/windows]
process history=true
Check for any new processes in the last 5 m

What's Changed
This version adds two new dashboard widgets that showcases some statistics as well as a network graph.
I also fixes and issue relating to calculating network measurements.
It also changes the tools bar slightly to make them a bit less intense:
Other changes:
- three new metrics which contains the refresh times of metrics, system metrics and network metrics so you can see this in the web UI.
- Removes unnecessary scientific notations for number in the metrics api so now you will get 1 instead of 1E1. Both are valid json so this should not impact anyone as long as your not using grep or some such to parse the json.
- Added network metrics to web UI by @mickem in https://github.com/mickem/nscp/pull/1199
Full Changelog: https://github.com/mickem/nscp/compare/0.11.25...0.11.26

What's Changed
Fixes an important bug in NRPE which was added in 0.11.24
Full Changelog: https://github.com/mickem/nscp/compare/0.11.24...0.11.25

This release includes significant, but experimental, Linux support.
While it has always been possible to use and build NSClient on Linux we now build official packages which are ready to be installed.
In addition to this there are a lot of fixes and enhancements to make running on Linux much more viable.
🐧 Experimental Linux Support
The Linux version is now complete and mirrors the Windows experience more closely than ever before.
- Unified Commands: CheckSystemUnix has been renamed to CheckSystem. Linux users can now use the same configuration as Windows users.
- Distribution-Specific Binaries: We now provide optimized builds for Debian, and Rocky Linux (redhat).
- Scripting Parity: Full support for Python and Lua scripts is now available on Linux, including proper script-folder routing.
- Permission Improvements: Default logging on Linux is now directed to the console, allowing the agent to run without sudo when testing. Also now certificates are generated when you run nscp web install to prevent sudo requirements when running as a service.
🛠️ Installer & Core Stability
After a series of regression tests in the 0.11.x branch, the installer has been hardened.
- Fixed Upgrade Logic: Resolved a critical issue where a DLL name change caused the WiX installer to fail or leave files missing during upgrades in some instances.
- Configuration Protection: Added safeguards to prevent the installer from overwriting or wiping existing .ini configurations during an upgrade.
- Silent Install Flags: Reintroduced and documented ALLOW_CONFIGURATION=0 for msiexec, allowing admins to deploy the MSI without touching existing config files.
🏗️ Architectural Refactoring
- Modular Codebase: Significant internal refactoring of nscapi and protobuf functions to improve long-term maintainability.
- Windows Core Cleanup: Reorganized Windows-specific code into a dedicated internal directory structure to separate it from cross-platform logic.
- Enhanced Testing: Many unit tests as well as a new Azure-based automated integration test.
⚠️ Upgrade Note for Pre-Release Users
If you are currently running any pre-release version between 0.11.9 and 0.11.20, a direct upgrade may fail due to either invalid DLLs or missing configuration.
Recommended Path: Manually uninstall the pre-release version and then perform a fresh installation of this release. Your configuration files will be preserved if you do not manually delete them.
⚠️ Upgrade Note for ALLOW_CONFIGURATION=0
If you use ALLOW_CONFIGURATION when upgrading from an old version the configuration might be deleted. This is an issue which is in the old installer and thus not possible to fix. This has however been fixed in future upgrades.
Full Changelog: https://github.com/mickem/nscp/compare/0.11.23...0.11.8

What's Changed
- Fixed installer placing scripts in the wrong folder. And added test to prevent it from happening again.
- Updated mongoose to 7.20
- Updated boost 1.86
- Updated Lua to 5.4.7
New Contributors
- @Copilot made their first contribution in https://github.com/mickem/nscp/pull/1126
Full Changelog: https://github.com/mickem/nscp/compare/0.11.7...0.11.8

What's Changed
Minor update with only some web page dependencies and such updated (mainly done to remove dependabot PRs) as well as some pipeline changes.
Full Changelog: https://github.com/mickem/nscp/compare/0.11.6...0.11.7

What's Changed
Adds new check_nsclientclient. Which is a stand-alone application you can use to connect to and interact with NSClient.
This new client can run:
- Run queries/checks
- Change configuration
- Show logs
- Load/unload modules
It also have an interactive client you can use which is aimed as a replacement for "test mode".
To connect to NSClient you need to have the web server enabled and then you can login with the same username and password as you use in the web-ui:
$ check_nsclient nsclient auth login --password PASSWORD --ca %LOCALAPPDATA%\mkcert\rootCA.pem
Successfully logged in
Credentials are securely stored in store in credential manager.
The reason there is a nsclient command line option is that soon this will also support NRPE and other protocols as well becoming a universal monitoring tool.
After this you can show logs:
$ check_nsclient nsclient logs list
╭───────┬──────────────────────┬─────────────────────────────────────────────────────────────────╮
│ level │ date │ message │
├───────┼──────────────────────┼─────────────────────────────────────────────────────────────────┤
│ debug │ 2026-Jan-11 12:36:26 │ NSClient++ 0.4.0 2026-01-11 x64 booting... │
│ debug │ 2026-Jan-11 12:36:26 │ Booted settings subsystem... │
│ debug │ 2026-Jan-11 12:36:26 │ Archiving crash dumps in: C:\src\build\nscp/crash-dumps │
│ debug │ 2026-Jan-11 12:36:26 │ Found: CheckExternalScripts │
│ debug │ 2026-Jan-11 12:36:26 │ Found: CheckSystem │
│ debug │ 2026-Jan-11 12:36:26 │ Found: Checkhelpers │
│ debug │ 2026-Jan-11 12:36:26 │ Found: LuaScript │
│ debug │ 2026-Jan-11 12:36:26 │ Found: NRPEServer │
│ debug │ 2026-Jan-11 12:36:26 │ Found: WEBServer │
╰───────┴──────────────────────┴─────────────────────────────────────────────────────────────────╯
Or to load and enable a module you can:
$ check_nsclient nsclient modules use CheckHelpers
Successfully loaded and enable module CheckHelpers
Or you can execute queries:
$ check_nsclient nsclient queries execute-nagios check_cpu
OK: CPU load is ok.|'total 5m'=10%;80;90 'total 1m'=10%;80;90 'total 5s'=7%;80;90
As well as launch the new interactive client:
check_nsclient nsclient client
The client is included in the installer or it can be downloaded separately below as check_nsclient
One benefit of this client is that it can output everything as text, json, yaml or csv making it easy too integrate in any system:
$ check_nsclient --output json nsclient queries execute check_cpu
{
"command": "check_cpu",
"lines": [
{
"message": "OK: CPU load is ok.",
"perf": {
"total 1m": {
"value": 12.0,
"unit": "%",
"warning": 80.0,
"critical": 90.0,
},
"total 5s": {
"value": 21.0,
"unit": "%",
"warning": 80.0,
"critical": 90.0,
},
"total 5m": {
"value": 11.0,
"unit": "%",
"warning": 80.0,
"critical": 90.0,
}
}
}
],
"result": 0
}
Other changes in this version:
- Tokens for the WEB UI now expire after 8 hours.
- Some missing python scripts have been added to the installer
Full Changelog: https://github.com/mickem/nscp/compare/0.11.5...0.11.6

What's Changed
Minor update which has some code and documentation changes as well as one bugfix:
- check_process should show memory values in human readable form i.e. 1234567 (bytes) should be converted to 1.236MB. This is similar to how other size related check work.
An example of how it now looks:
check_process "warn=working_set > 3G" "crit=working_set > 5G" "detail-syntax=%(exe) working-set: %(working_set)"
L cli WARNING: WARNING: clion64.exe working-set: 3.945GB
Full Changelog: https://github.com/mickem/nscp/compare/0.10.8...0.10.9

What's Changed
Minor release which adds NSCA documentation and a command line option for nscp nsca to set the host name --hostname.
The NSCA Guide can be found here
nscp nsca --host 127.0.0.1 --password secret-password ^
--encryption aes256 --command "service check" --result 2 --hostname "my host name" --message "Hello From command line"
It also adds test cases against real NSCA server to ensure compatiblity.
Full Changelog: https://github.com/mickem/nscp/compare/0.10.7...0.10.8

PLEASE NOTE That there is a new legacy-xp binary which can be used on older version of windows..
NRPE updates
- NRPE setup now supports 2-way tls
- Also fixed many issues with the cli to make ti tork more reliable.
Command to set up 1-way TLS NRPE server
nscp nrpe install --allowed-hosts 127.0.0.1 --insecure=false ^
--verify=none --certificate nsclient.pem --certificate-key nsclient.key
nscp nrpe install --allowed-hosts 127.0.0.1 --insecure=false ^
--verify=peer-cert --certificate nsclient.pem --certificate-key nsclient.key --ca ca.pem
Installer:
Added installer option IMPORT_CONFIG to allow copying a configuration during installation.
This is a great way to simplify configuration distribution during installation if you do not have better tools in place.
To import the configuration from a http server you can do:
$ msiexec /i NSClient++.msi IMPORT_CONFIG=http://myserver.com/nsclient.ini
This release also fixes import of http configuration so you can do:
$ nscp settings --migrate-from https://raw.githubusercontent.com/mickem/nscp/refs/heads/main/tests/rest/nsclient.ini
Improved how debug in queries work
Using the debug option with queries is now much simpler.
First it will return the debug data instead of adding it to the log making it possible to use this remote (please note that many protocols have payload limits).
The output is now simplified as it includes useful details about the object as well as a standardized list:
ignored c:\src\nscp\build\docker\debian-9\Dockerfile
match c:\src\nscp\build\docker\files\plugin_pb2.py
ignored c:\src\nscp\build\perl\echo_date.pl
match c:\src\nscp\build\python\config.py
warning c:\src\nscp\build\python\create_plugin_module.py
match c:\src\nscp\build\python\create_zip_module.py
match c:\src\nscp\build\python\mk_pyzip.py
Where:
ignored means the item did not match the filter
match means the item matched the filter and was not critical nor warning.
warning and critical means the item is a warning or a critical.
Windows XP support: is back
This version brings back experimental Windows XP support.
As I am unable to get a Windows XP machine up and running I cannot verify it but it runs on Windows 2008 (which is the oldest test machine I have) and in theory it should run on Windows XP with a lot of service packs.
If you have access to old machines, please do give it a spin and let me know how it goes.
To install NSClient++ on Windows XP use the Win32-legacy-xp packages below.
Please note: MSI files might not work (as it requires newer MSI version) but you should be able to use the zip in those cases.
Documentation
- Updated links and fixed various markdown issues making the documentation easier to read.
- A new guide explaining how to configure NRPE with and without certificate authentication making on boarding NRPE much much easier.
- Many other changes and fixes in the documentation
Updated to OpenSSL 3.5.x:
This is actually huge as OpenSSL which I updated to a year or so ago when I started to updated dependencies was the last 1.1.1 version.
There are numerous changes is 3.5.4 which we will eventually start to benefit from but for now the only benefit is that the certificate generation is a bit improved.
Various minor improvements:
- Fixed some configuration keys which where missing the comment describing what they are in the config file.
- Added option debug verify to show why certificate validation fails, this option will likely be removed and replaced by default handling in the future.
- check_memory Change text syntax of check_memory from only show used to show "type: used/total"
- CheckExternalScripts Added new option under [/settings/external scripts] called kill tree=true to kill process tree when exiting process.
- Fix for update not working on Windows 2025
- Updated the mongoose web server to latest version (and dependency)

What's Changed
- Default generated certificates are now sha256 by @mickem in https://github.com/mickem/nscp/pull/1022
Full Changelog: https://github.com/mickem/nscp/compare/0.9.14...0.9.15

What's Changed
- Fixed check_ping issue when two queries are running at the same time
- Added option to check_ping to set payload
- Added drop to scheduler channel to ignore results (set channel name to drop and anything sent there will be dropped)
- removed unused(?) python dependency
- Fixed python dependencies (again), now builds will break if python dependencies break.
Full Changelog: https://github.com/mickem/nscp/compare/0.9.13...0.9.14

What's Changed
- Added missing python lib required for PythonScript module
- Some internal pipeline fixes and documentation updates
Full Changelog: https://github.com/mickem/nscp/compare/0.9.11...0.9.13

A summary of all changes since 0.8.0 which was the previous released version, if you have been using pre-releases then there are no changes.
REST API updates
Removed some old (deprecated) rest API endpoints.
The oldest REST apis (endpoints starting without /api) were not stable as they exposed an JSON representation of the internal NSClient++ messages.
To mitigate this the newer endpoints (which is found in the documentation) starting with /api/v1 or /api/v2 were added several years ago.
Many of these old endpoints have now been removed which allowed us to migrate from the outdated JSON library to a more modern one.
Note: The old check endpoints have NOT been removed to retain compatibility with Icinga and similar tools.
In addition to this I have also added numerous integration test to help to keep the APIs stable.
Installer improvments
The installer has been updated a lot to behave more predictably and in general work better.
I have also added numerous tests to the installer to ensure less accidental breaking changes in the future.
Should not impact anything but instead of a dedicated Json library we now use boost to reduce number of dependencies.
Removed sample config from installer (as you can easily generate the config i removed it from the installer).
Documentation for installer config options have also been updated.
One of the biggest changes now is that how keys are overridden behave more predictably:
1. The tool (generic or op5) set the value
2. Any existing configuration file will override the value set by the tool
3. Any property (command-line or UI change) will override the value set previously
4. Any value which is not same as config or default will be written during install.
It will also handle rest settings and boot.ini properties correctly.
Web UI improvements
The web interface has gotten a medium overhaul improving settings and queries.
You can now change setting under modules.
Settings now have widgets for boolean settings
Settings view now show all settings not just changed ones.
You can now use " in queries when executing from the Web UI so "filter=1 > 2" is now possible,
Improved settings and log widgets
Updated installer (fixed overriding keys from command line)
Added test cases for installer
Restored Linux builds
This is still a work in progress but for now you can build and run NSClient++ on Linux (there are pipelines as well for this).
"Soon(TM)" I will add some packages and config files and such to make it more usable.
Various other bugfixes:
- Fixed https settings caching when using http(s) settings.
- Fixed lots of compiler warnings and linting
- Fixed indexing in arrays in lua
- Fixed help screen typo by @vanitysys28 in #965
- Installed should not place op5.ini config in subfolder (like since 0.6.x)
- Settings now have a type (string, int, bool, etc)
- Fixed: Hostname should not be lowercased
- Change log level for connection closed when reading request to debug
- Added signatures to exe files by @mickem in #981
In this release nscp.exe and check_xxx.exe are digitally signed making using them hopefully a bit simpler on secured machines.
Full Changelog: https://github.com/mickem/nscp/compare/0.9.10...0.8.0

What's Changed
Sensitive keys
Added the ability to mark keys as sensitive which can then be configured to be stored in credential manager.
Meaning you now have a way to keep secrets and passwords out of the config file.
To enable this you simply enable credential manager:
[/settings]
use credential manager = true

And re-save the config file:
nscp settings --update

Now this is not quite as simple in the real world.
Credential manager is per-user meaning that if you run NSClient++ as Local System you have to run nscp settings --update as the local system user.
A quick way to achieve this is to use PsExec:
PsExec -i -s "c:\program files\nsclient++\nscp" settings --update

After running this in your config file all passwords will be replaced by:
[/settings/default] password = $CRED$; Se credential manager: NSClient++-/settings/default.password

This is not the default as it is difficult to integrate with the installer.
To revert this back you simply change the parameter and update again:
PsExec -i -s "c:\program files\nsclient++\nscp" settings --path /settings --key "use credential manager" --set false
PsExec -i -s "c:\program files\nsclient++\nscp" settings --update

Modern TLS Support for remote settings
Remote settings via https (TLS) has been improved to now support TLS 1.3 as well as certificate validation.
This is configure in boot.ini (NOT nsclient.ini as that's the file loaded remotely).
[tls] version=1.3
verify mode=none

To enable certificate validation instead use the following config (where ca.pem contains the CA used to issue the server certificate):
[tls] version=1.3
verify mode=peer ca=c:\program files\NSClient++\security\ca.pem

This can be used with the installer as well by setting TLS_VERIFY_MODE=peer TLS_CA=c:\my-ca.pem:
msiexec /i c:\tmp\NSCP-0.8.0-x64.msi CONFIGURATION_TYPE=https://my-server.com/nsclient.ini TLS_VERIFY_MODE=peer TLS_CA=c:\tmp\ca.pem

A guide to securing NSClient++
I have also started to write a guide on how to secure NSClient++.
This is a work in progress but for now contains information on options for securing passwords in the config file.
Change log
- Added sensitive config by @mickem in #938
- Added tls13 client by @mickem in #939
Full Changelog: https://github.com/mickem/nscp/compare/0.7.0...0.8.0