A locked-down modern Windows layout, new security and system checks, and safer settings and roles

This release introduces an opt-in modern Windows file layout that separates and locks down the agent's writable state, adds a batch of Windows security and system checks, and hardens two areas of the WEB/settings surface. Default installs are unaffected until you opt in to the new layout.

Highlights

• Modern, locked-down Windows file layout (opt-in). Configuration, the fleet identity, and writable state can now live in a dedicated %ProgramData% folder that is restricted to SYSTEM and Administrators, instead of sitting under Program Files. Switch with nscp settings --migrate-layout modern (or the MSI LAYOUT property); the classic layout remains the default and is untouched.
• Writable state and a fleet folder are first-class. A ${fleet-folder} token and dedicated writable-state directories keep fleet/enrollment material and mutable state out of the package/program directories, with local overrides now visible in diagnostics. On Linux packages the writable state directories are created and migrated automatically.
• New CheckSecurity checks. check_activation (Windows licensing state), check_file_security (file owner / DACL hardening), and check_firewall_rules (assert on individual firewall rules).
• New CheckSystem checks. check_w32time (Windows Time service health) and check_printjobs (per-job print detail), plus reporting the printer device behind each queue.
• Sensitive settings values are redacted on read. The REST settings read endpoints and the nscp settings --list / --show CLI now return *** for keys registered sensitive, matching the diff endpoint. Reported by @yagust.
• The legacy WEB permission is flagged and no longer seeded by default. It unlocks deprecated query-dispatch endpoints that can run any registered command; fresh installs no longer create the role and a SECURITY warning is logged for any role that grants it. Reported by @yagust.
• A documented upgrade path. New Upgrading and Security notices docs pages collect per-version operator actions and security-relevant changes in one place (#1410).

Detailed changes

Modern Windows file layout

The agent can now run in a "modern" layout where its configuration, fleet identity, and writable state live in a dedicated, ACL-restricted %ProgramData% folder rather than under %ProgramFiles%. The layout is recorded in boot.ini and resolved through a single shared path-token table used by both the service and the bundled clients, so ${shared-path}, ${log-path}, ${fleet-folder} and friends resolve consistently everywhere.

Migration is available both from the CLI (nscp settings --migrate-layout modern, with --dry-run) and from the MSI (via a LAYOUT property). The migration is defensive: it refuses to move into a populated destination on the first switch, locks the destination down before writing any secret into it, moves across volumes rather than failing, and keeps shipped program content out of the redirected shared path.

New and updated checks

• CheckSecurity: check_activation, check_file_security (owner + DACL hardening), and check_firewall_rules (individual rules). Corrected three check_file_security verdict paths and kept expect= assertions visible through a firewall filter.
• CheckSystem: check_w32time for the Windows Time service, check_printjobs for per-job print detail, and the printer device is now reported behind each queue. Duration keywords keep their -1 sentinel and last_sync_age is treated as a duration.
• CheckDocker: survives containers removed mid-check and counts image disk correctly.
• CheckMySQL: plugin-dir / socket / defaults-file are settings-only.

Security & hardening

• Settings redaction (reported by @yagust): values for keys registered sensitive are returned as *** on the settings read paths (REST GET /api/v2/settings/... and /descriptions, and the --list / --show CLI), matching the diff endpoint. Internal reads a module makes of its own configuration are unaffected. This is defense-in-depth, not an authorization boundary — the plaintext still lives in nsclient.ini. The web admin edit dialog now writes only changed fields so the mask cannot overwrite a stored secret.
• Legacy WEB permission (reported by @yagust): the legacy grant unlocks the deprecated /query.pb and /query/{name} endpoints, which dispatch through the same command registry as /api/v2/queries. The built-in legacy role is no longer seeded on fresh installs, any role whose grant includes the legacy token now logs a SECURITY warning at startup (and from nscp web add-role / add-user), and the capability is documented in the securing guide.

Installer & packaging fixes

• Repaired a self-initialised member and a clobbered boot.ini; stopped stamping [layout] into every boot.ini.
• Remove the fleet identity on uninstall of a modern install; restore the config backup into the layout's shared folder; honour boot.ini's [paths] shared-path.
• Linux packages create and migrate writable-state directories and keep them out of the package directory; adopt_owner handles root-written enrollment material and is symlink-safe.

Documentation

• New Upgrading page collecting per-release operator actions (closes #1410), and a Security notices page tracking advisories and hardening changes.
• Documented the Windows and Linux file layouts and the MSI LAYOUT property.

Upgrade notes

• The modern layout is opt-in; the default install is unaffected. Switch deliberately with nscp settings --migrate-layout modern (try --dry-run first) or the MSI LAYOUT property. Run the CLI migration from an elevated prompt — the destination is locked to SYSTEM/Administrators.
• 🔒 Sensitive settings values now read back as ***. Tooling that read a secret out of GET /api/v2/settings/... will now receive *** for keys registered sensitive. No configuration change is required.
• 🔒 The legacy WEB role is no longer seeded on fresh installs and any role granting the legacy permission logs a SECURITY warning. Existing installs keep their role and are unaffected; only grant legacy to trusted legacy systems.
• Linux writable-state migration is automatic. Packages create and migrate the writable state directories on upgrade; no action required.

Full Changelog: 0.16.1...0.16.2