Firefox: Mass Management on Windows Environment

Introduction link

You probably manage your Internet Explorer configuration via GPO under Active Directory. This is convenient, there are plenty of options, but logically there is nothing by default for alternative browsers.

The first issue you will encounter is the lack of MSI by default. You have 2 options:

1. Use SCCM¹ (formerly SMS) to deploy .exe files
2. Use repackaged versions in MSI format² and deploy them via GPO.

We will use the first option here because SCCM allows you to do much more than classic GPO deployments. However, we won’t cover how to set up deployment via SCCM or GPO as tutorials are plentiful on the internet, and we’ll focus on the Firefox part.

We will use the Firefox plugin called GPO for Firefox³. This plugin allows Firefox, when launched, to look at registry properties (which will have been pushed by GPO) to force default values in Firefox’s “about:config” and make them non-modifiable by the user.

It’s possible to go a bit further with Firefox repackaging by implementing additional default features via the CCK plugin⁴.

Prerequisites link

For the prerequisites, we’ll need at minimum:

• An Active Directory + DNS server
• An SCCM server
• A Windows 7 client

Installation link

Firefox link

Add the Firefox extension “GPO for Firefox”⁵ by repackaging it if possible so that it’s installed by default.

GPO on AD link

We’ll install the GPOs on the server where Active Directory is located. First, download the file containing the new GPO entries for Firefox: https://sourceforge.net/projects/gpofirefox/files/firefox.adm/download⁶

Then launch the Users and Computers interface:

We’ll install the GPO at the domain level, but you can also do it at the GPO level if you wish. Go to domain properties:

Here’s the procedure to follow:

1. Click on the GPO tab (Group Policy)
2. Add a new GPO
3. Name it in a recognizable way
4. Click Edit to edit it

Now we’ll add the firefox.adm file to access the new options. Position yourself on “Administrative Templates” and click on “Add/Remove Templates”:

Add the firefox.adm file:

Then you should now see it appear:

Configuration link

Configuration of the GPO link

Configuring the GPO is quite simple once you understand the principle. It’s possible to force certain Firefox properties from the GPOs on the user or computer side. You can choose what works best for you. Depending on what you choose, the user-side parameters that will be in the registry can be found here:

• HKLM or HKCU\Software\Policies\Mozilla\LockPref for locked preferences
• HKLM or HKCU\Software\Policies\Mozilla\defaultPref for default preferences

One of the first parameters to apply is the following: activating the GPOFirefox module:

We activate it and hide it from the list of classic applications:

You have the ability to access most of the functions present in “about:config” in the “Mozilla Advanced Options” folder.

References link