Deploying Firefox Preferences Through Group Policy

[EveningStarNM]

I'm building an ADMX/ADML set that can be used to configure an extensive list of group policy settings that set registry keys which correspond to Firefox's Preferences in about:config and other settings. Those registry items are then read by an application that writes the corresponding configuration settings to mozilla.cfg, override.ini, and other files that Firefox uses to define its operating parameters.

There are several issues involved in deploying those settings. What is the best way to deploy them in an Active Directory environment? The registry settings can be distributed to workstations through Group Policy, and the application that implements those setting can be run as a scheduled task. This makes each machine responsible for configuring it's own settings. Alternatively, the configuration files, themselves, can be distributed to domain members as needed. There are certainly other methods that I haven't considered, but those are the two methods that most people seem to be using. (Please note that I'm not talking about custom configurations that are deployed only during installation or update.)

Bandwidth, reliability, and security are, I think, the most important considerations in choosing the method of deployment, but there are certainly other factors, and I haven't been able to find a good discussion of them as they relate to Firefox. I'm very interested in hearing other people's ideas about how best to deploy timely configuration changes to Firefox. The biggest obstacle is, of course, that Firefox doesn't live-update itself with changes to many settings. The browser must be restarted to effect those changes, but that's a limitation that can't be avoided without being severely rude to the user.

So, my question is this: What's the best way to distribute Group Policy settings for Firefox to Active Directory member workstations? By using an application that runs on each workstation and reads those settings from a workstation's registry? By distributing the actual configuration files to each workstation? Or is there another way?

[Brummelchen]

go and read here viewtopic.php?f=38&t=2931107

GPO? --> CCK

[EveningStarNM]

go and read here viewtopic.php?f=38&t=2931107

GPO? --> CCK

CCK doesn't exist anymore, and CCK2 is a pre-installation configuration tool. It's very useful, and I can't imagine how any enterprise that deploys Firefox could do without it unless they had a lot of money to burn, but that's not what I'm discussing here. I want to manage Firefox post-deployment through Group Policy.

[Brummelchen]

CCK or CCK2 no matter - but relevant for distributing modified settings
what you search for is mozilla.cfg
http://kb.mozillazine.org/Locking_preferences
https://developer.mozilla.org/en-US/doc ... g_settings

and again - firefox is not GPO compatible, you need tricks and more:
https://de.websense.com/content/support ... olicy.aspx

HTH

[EveningStarNM]

CCK or CCK2 no matter - but relevant for distributing modified settings
what you search for is mozilla.cfg
http://kb.mozillazine.org/Locking_preferences
https://developer.mozilla.org/en-US/doc ... g_settings

and again - firefox is not GPO compatible, you need tricks and more:
https://de.websense.com/content/support ... olicy.aspx

HTH

Yes, I know about autoconfig files. And, actually, Firefox can be configured according to settings in a GPO. A competent developer can create the ADMX/ADML files that save settings to the registry, then write an application that reads those settings and writes the appropriate javascript code to the autoconfig files, e.g., as lockpref functions. That application can be scheduled to run at user log on or anytime. When Firefox starts, it configures itself according to those prefs. It's not actually very difficult.

It's already been done and demonstrated. For instance, Mark Sammons, with FirefoxADM, and Nathan Felton, with Firefox ADMX, have proven the technique. All I'm doing is refining and (greatly) expanding the capabilities of similar software. It works very well. These are the setting my application can configure from Group Policy right now:

app.update.auto
app.update.badge
app.update.channel (in channel-prefs.js)
app.update.enabled
app.update.incompatible.mode
app.update.mode
app.update.silent
browser.download.manager.showWhenStarting
browser.rights.3.shown
browser.search.update
browser.shell.checkDefaultBrowser
browser.startup.homepage
browser.startup.homepage_override.mstone
browser.startup.page
browser.urlbar.trimURLs
EnableProfileMigrator (in override.ini)
extensions.blocklist.enabled
extensions.blocklist.url
extensions.shownSelectionUI
extensions.update.enabled
extensions.update.notifyUser
media.peerconnection.enabled
media.peerconnection.ice.default_address_only
media.peerconnection.ice.force_interface
security.OCSP.enabled
security.OCSP.URL
security.ssl.require_safe_negotiation
security.ssl.treat_unsafe_negotiation_as_broken
signon.rememberSignons
startup.homepage_override_url
startup.homepage_welcome_url
toolkit.telemetry.enabled
toolkit.telemetry.prompted
toolkit.telemetry.rejected

I'm adding more settings every day. My question is not "Is it possible to configure Firefox using Group Policy". The answer is "yes". I've done it. That problem is solved. My questions is about how best to distribute the settings to workstations. CCK has a different purpose. It provides for creating customized installation packages. I'm talking about managing Firefox after it's been installed.

[Brummelchen]

install it again with a cck modded version - distributing pre-defined and locked settings.
or write eg an autoit script to kill firefox and modify prefs.js. but that is not part of this forum.