Welcome to policy-templates Discussions!

[mkaply]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[SebClaudin]

Hello !

I'm Seb, I work as a sysadmin in my college in france, and it's great to have access to a template that works with firefox. I have a problem with the proxy settings with this template, but I cannot create a new discussion because I cannot select a category in this discussion forum ... has someone the same problem ?

[mkaply]

That's odd. So selecting a category on this page doesn't work?

https://github.com/mozilla/policy-templates/discussions

[Sunyix11]

Hi,

We already set the "PasswordManagerEnabled" option in intune:

PasswordManagerEnabled
Windows (Intune)
OMA-URI:
./Device/Vendor/MSFT/Policy/Config/FirefoxPolicyfirefox/PasswordManagerEnabled
Value (string):

but the some users do not want to use it, so is there any possibility to the users can override this option?
I did not find any related OMA-URI about it.

[mkaply]

It looks like we lost some information. can you add three single quotes around the OMA value?

So you want to block it for everyone, but allow some users to turn it on?

[Sunyix11]

We set the "PasswordManagerEnabled" to enabled in intune, but there are some users who want to switch off this function. So we search an option when the user can override this password save option and they can switch off this function.

[mkaply]

Enabled is the default state of password manager, so if you want folks to be able to turn it off, I would probably just not set it at all.

[Sunyix11]

is it true that Firefox stores credentials unencrypted on the local machine harddisk?

[Sunyix11]

and is there any way to remove these password db files (key4.db, logins.json) from all of the affected local device?

[mkaply]

Your passwords are not unencrypted, but they are unencryptable by a local attacker unless you are using a strong primary password" See: https://support.mozilla.org/en-US/kb/how-firefox-securely-saves-passwords

You could certainly delete those files, but we don't have a facility for doing that.

[Sunyix11]

Thank you very much for the quick reply!

[Sunyix11]

Hello!
I have an other question. We want to enabled the Firefox account synchronization in Intune and want to sync everything except the passwords. Is there any OMA-URI for this setting.

I found only this:
DisableFirefoxAccounts - Disable Firefox Accounts integration (Sync).

but is it possible that set the passwords to exclude list?
or how can we choose what to sync with policy?

[mkaply]

So in speaking to the team, there's no way to limit parts of sync like that because it's controlled by any other client.

[Sunyix11]

Thank You

[Dante-source]

Hello Everyone,

I'm working as a sysadmin for an IT company where they are using Firefox. I got a request to force end-users to use Primary Passwords so the saved passwords are fully encrypted.

I've figured out this part, users are enforced to set their Primary Passwords if they are using Sync and Firefox account, and they are also forced without using any of these.
My question is, what happens with the earlier saved passwords? So now we have users whose saved their passwords already, but they aren't forced to set Primary Passwords as of now. Do they get encrypted as well once the Primary Password is set?
Does it makes any difference if they have Sync and Firefox account or not, or the encryption behaves exactly the same?

+1
Is there a way to force to set up the Primary Password immediately once its set to required?
If the user is Sync and Firefox account user, he or she gets prompted immediately to set it.

If not, the user gets prompted when a new password is added, is there any workaround for this scenario?

Thank you in advance!
Regards,
Daniel

[Dante-source]

Dear mkaply,

Even tough that I'm restarting the browser I'm not forced to set up the Primary password, only if I'm logging into my Firefox account, or if I'm trying to save another password. My question would be, is it possible to enforce the users to set the Primary password once I've set the ./Device/Vendor/MSFT/Policy/Config/FirefoxPolicyfirefox/PrimaryPassword OMA URI by any means. The most ideal solution would be that they are prompted to set the Primary Password as soon as they open Firefox next time. Otherwise there could be a scenario where the user already saved 10 of his passwords, but doesn't logs into his Firefox account, nor he saves a new password, so those passwords which were saved before the OMA URI were set are less encrypted.

Regarding my question if the above mentioned 10 passwords are encrypted with the stronger type of encryption once the Primary password is set, thank you very much! :)

[mkaply]

Unfortunately there's no easy way to do this. We set it up so it enforces the primary password at the places where the user would normally be asked (the places you indicated).

The reason we didn't do it at startup is that we didn't want it to be annoying if a user hit cancel on the dialog and it came up at every startup.

[Dante-source]

Thank you for the explanation on the Primary password!

[Dante-source]

Dear @mkaply

Could you please let me know the outcome of the encryption when you has the time to test it?
I'm interested in if the already saved password are getting encrypted again with the stronger encryption after the Primary password has been set.

Thank you in advance!

[Dante-source]

Dear @mkaply

Do you had time to check if the already saved passwords are getting re-encrypted once the Primary Password is being set?

Thank you in advance!

[Sunyix11]

Hello,
Is there any Intune policy about Site isolation option?

[mkaply]

There is not. Is there a reason you want to change it?

[Sunyix11]

by default is it enable?

[mkaply]

Yes, it's been enabled quite a while as the default.

[Sunyix11]

Hello,
If we use the following ExtensionSettings Intune policy:

<data id="ExtensionSettings" value='
{
"*": {
"blocked_install_message": "Installation of extensions are blocked by policy",
"installation_mode": "blocked"

how can I allow the dictionary installs?

tried this, but unfortunately the dictionary install is still blocked:

<data id="ExtensionSettings" value='
{
"*": {
"blocked_install_message": "Installation of extensions are blocked by policy",
"installation_mode": "blocked",
"allowed_types": ["dictionary"]

Could you please help me?

Thank you in advance!

[mkaply]

Just remove installation_mode": "blocked" and you should be fine.

You're already blocking all other addons by just allowing dictionary.

[Sunyix11]

I removed it and now it is working fine!
Thank You very much!

[Sunyix11]

Hello,

If we set "PrimaryPassword" Intune policy, is there any way to track how many users have set it up? This setting modify the existing password db files or will create a new file? or it will make any change in registry?

Thank You in advance!

[mkaply]

Sorry, missed this. There's no way to know how many people have set a password.

[Sunyix11]

Hi,

I would like to use the following Intune policy to add an exception to the Tracking Protection:

OMA-URi:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/D_TrackingProtection_Exceptions

Value:

<data id="TrackingProtection_Exceptions" value="1&#xF000;https://example.com"/>

The policy was finished with success, but when I checked my test client there is no any exception set. Could you please help me why is not working for me?

Checked the about:policies in Firefox and found only these setting:

EnableTrackingProtection
Value - true
Crypto - true
Fingerp - true
Locked - true

no exception section anywhere.

Thank you in advance

[mkaply]

I made a mistake in the documentation. There should be an enabled before the data:

<enabled/>
<data id="TrackingProtection_Exceptions" value="1&#xF000;https://example.com"/>

Can you try that?

[Sunyix11]

It is working fine.

Thanks a lot

[Sunyix11]

Hello,
I need to set the following value from true to false:
dom.disable_window_flip

Could you please help me how can I set it with Intune policy and what exactly does this setting do?

Thank You in advance!

[mkaply]

So generally when people set this pref to false it's because they have some internal application that relies on being able to move window focus. The reason we default it to true on Firefox is for specific attacks where a user is encouraged to click somewhere and then a window pops up and they click there instead (a form of clickjacking). It's really a decision you would have to make.

[Sunyix11]

Hello,

Our customer does not want to apply this "dom.disable_window_flip" pref for all users, because of security reason. And they do not want an other Firefox Intune policy only for the affected users. So, is there any possibility to set this pref to False with a script or a separate Intune package? Is there any Windows registry setting which can we use for set the "dom.disable_window_flip" pref to false?
Thank you in advance

[mkaply]

Are you setting any other preferences with the Preferences policy?

[Sunyix11]

yes, the following pref are set:
"layout.spellcheckDefault"
"browser.tabs.closeWindowWithLastTab"
"browser.safebrowsing.malware_enabled"

[mkaply]

Then you would have to create a unique policy for those users who have a different value. There's no other way to do it.

[Sunyix11]

Hi Michael,

I would like to set the following preferencies regarding Spellcheck and "window flip" in our Firefox configuration profile:

OMA-URI:
./Device/Vendor/MSFT/Policy/Config/FirefoxPolicyfirefox/Preferences
Value:

but unfortunatelly nothing happend.

and I found that the browser safebrowsing preference already set:

OMA-URI
./Device/Vendor/MSFT/Policy/Config/FirefoxPolicyfirefox~Preferences/browser_safebrowsing_malware_enabled
Value: enabled

Could you please help me how can I implement all the 3 setting? because I am a little bit confused that the OMA-URI are different:
./Device/Vendor/MSFT/Policy/Config/FirefoxPolicyfirefox/Preferences
./Device/Vendor/MSFT/Policy/Config/FirefoxPolicyfirefox~Preferences/browser_safebrowsing_malware_enabled

It seems the 2 preferences setting are conflict.

Thank you in advance!

[mkaply]

So you have to either use the new JSON method or the old Preferences method, you can't use both.

So you would remove the old one and set the safebrowsing pref in the new policy.

[mkaply]

I will point out that Intune/Endpoint Manager is really bad at removing stuff so if that doesn't work, we can use the old preference infrastructure to set those prefs.

[Sunyix11]

Thank you!
So, First I would like to try the new JSON method and I will delete the old preference method.
Could you please help me that the safebrowsing section is right? I am not sure that the value is "1" or "true" if I want to enable the safebrowsing malware.

[Sunyix11]

Sorry for the lot of questions, but I have an other topic. We have to set that the last tab does not close the program.

I did not find the browser.tabs.closeWindowWithLastTab = false setting in the documentation.
Could you please help me how can I set it with Intune policy?

Thank you in advance!

[mkaply]

True is correct. You can check by going to about:config.

For the intune policy, you would set:

"browser.tabs.closeWindowWithLastTab": {
   "Value": false,
   "Status": "locked"
}

[Sunyix11]

It is working fine, with the new JSON method!
thank you again! :)

[Sunyix11]

Hi Michael,

Currently, the Firefox language set to English by default. When the users try to add the Deutsche language (Select a language to add...) and try to set it, nothing happen. The English stay the preferred language. Could you please help me how can I allow the users to choose their preferred language? Is there any OMA-URI setting for Intune environment?

Thank you in advance!

[Sunyix11]

Yes, we blocked all extension install and we have an allow policy for the necesarry extensions.

[mkaply]

You'll need to add an allowed_types section and put "locale" in it

IT should still allow your explicitly enabled extensions.

[Sunyix11]

Our extension setting start with the followings:

<data id="ExtensionSettings" value='
{
"*": {
"blocked_install_message": "Installation of extensions are blocked by policy",
"allowed_types": ["dictionary"]
},

after it there are some force extensions install and some allowed extensions install.

So, you mean that should I change the "allowed_types": ["dictionary"] to "allowed_types": ["locale"] or should i add a separate row with "allowed_types": ["locale"]

Sorry, for my lot of questions.

and Thank you for your answers

[mkaply]

Change it to "allowed_types": ["dictionary", "locale"]

[Sunyix11]

Thank You, It is working fine!

[Sunyix11]

Hi Michael,

Our customer wants to change the Firefox on all devices. Currently, there is an Intune application Win32 package (Mozilla Firefox 91.0.1esr x64 en) which installed on 5 thousands devices. The customer want to change this win32 package with a new Winget Firefox (UWP) application. In this case we need to uninstall all the old Firefox app from the devices and install the new one. We tried that the Intune policies working fine with the new winget package. Unfortunately, the history and the bookmarks will be lost because of the uninstall. Do you have any idea how can we managed the bookmarks export and restore? If we set this preference "browser.bookmarks.file" on the old Firefox maybe the bookmarks will restore to the new Firefox or this bookmark file will be lost with the uninstall?

Thank You

[mkaply]

My guess is the new Firefox is being installed in a different location which is what is causing you to get a new profile.

If you use the LegacyProfiles policy in GPO it should prevent this from happening

https://github.com/mozilla/policy-templates/blob/master/README.md#legacyprofiles

[Sunyix11]

As you suggested, I tried to set the LegacyProfiles with Intune policy, but when the policy was applied on my test device all bookmarks are gone. So, if this setting would have been set from the beginning than it would be a good solution.
We use the new JSON method for the preference config. Is there any possibility to backup the history to a html file? Because if we have a backup html file from all user bookmarks maybe we will restore it to the new Firefox (winget version)

[mkaply]

When you go to about:profiles, do you see the other profile that has your bookmarks in it?

There are two preferences you can set:

browser.bookmarks.autoExportHTML
browser.bookmarks.file

which will cause bookmarks to be exported on shutdown to that file.

[N02896]

Forgive me if the answer is obvious. I'm a new sysadmin and new to github trying to do a Linux Firefox STIG and we have no policies.json file. Firefox is essentially not configured.

I see reference to policies.json in the readme but there's no linux folder in mozilla/policy-templates just the MAC .plist or Windows .adml. Is there no pre-written .json template available to download?

[mkaply]

We don't have a prewritten JSON for the STIG. Each entry in the STIG has a section that says what to do on policies.json

Linux "policies.json" file:
Add the following in the policies section:
"SSLVersionMin": "tls1.2" or ("SSLVersionMin": "tls1.3")

That's probably worth me doing though, having a sample policies.json.

[mkaply]

It will still need modification though (as the mac plist does).

[N02896]

Thanks for the response. I suspected this was the case and ended up writing my own file in the meantime.

[mkaply]

Done. https://github.com/mozilla/policy-templates/blob/master/linux/policies.json

[Sunyix11]

Hi,

We have a Firefox update issue, because the browser autoupdate is enabled via Intune policy, but our clients are still on 114.0.1 version, so the autoupdate policy is not working properly. If I understand correctly, a restart is necessary for the update to be completed (or the update will be applied without browser restart?), so maybe there are some users leave their devices on for weeks and in this case the Firefox stay on the old version.

I did not find any Intune policy which will inform the user about the restart and it will be restarted automatically and finish the update process. Do you have any idea, how can we force the restart after the successful update?

Or is there any other option for update the browser without user interaction (powershell script or a cmd command which will trigger the autoupdate process)?

Currently, we use the following update policies:
AppAutoUpdate - True
DisableAppUpdate - False

Firefox Standard Version
OS: Microsoft Windows
our devices still on 114.0.1.0 version

Thank You in advance!

[mkaply]

We do not have a way to force updates at this time. We rely on the user to restart.

We are working on this.

[Sunyix11]

Thank you, so the restart is necessary for complete the update process?

[mkaply]

Yes, it is.

[Sunyix11]

Do you have any information about the slow auto update issue, because the 114.0.1 was released 9th of June, so if the autoupdate would work as in the past, I think our devices already received the new 115.0.1 version. "the background service to install the updates" is enabled on our devices.
Sorry for the lot of questions, but the security team forced this topic :(

[mkaply]

My guess is you're seeing this because we've had to pause Firefox 115 updates to do some issues that have come up (and have since released 115.0.1 and 115.0.2). You should be seeing the updates soon.

[Sunyix11]

Hello,

Unfortunately, we still have problems with Firefox automatic update. 1000 devices updated successfull to 115.0.3, but there are 4000 devices which stuck on 115.0.1 version. By default the "Use a background service to install updates" setting is enable and the scheduled task for the background update is exist. I checked the related intune policies on the github page and found the following:
"BackgroundAppUpdate"
Currently, this policy is not configured in our environment. Could you please help me what is the different the
"Use a background service to install updates" and the "BackgroundAppUpdate" setting?
The "BackgroundAppUpdate" is necessary to set enabled with intune policy for the background update to work correctly?

Thank you in advance!

[Sunyix11]

• We installed the Firefox with installer. From the Installer we created an Intune package and distributed for the devices.
• I checked the Mozilla Maintenance Service and it is in "manual" status. I think, it means, that if necessary the firefox can start it.
• Users already have profiles
• We enable the option to choose any language, so some devices maybe use different, but for example on my device is English is the default and the background update is not working (only if I start the Firefox browser)
  -Firefox connection settings configured to use the system proxy - I've checked.
  -Firefox schedule task is available

The background service is the "Mozilla Maintenance Service" ?
because it is not running and this is a manual service - not automatic

[mkaply]

The background service is Firefox. It's started with a special parameters. Them maintenance service is what does the actual install.

My suggestion here would be that we get a bug opened in bugzilla.mozilla.org and work with the install team to figure out what's going on.

[Sunyix11]

I've opened a ticket: Bug 1846764
Thank you for your help

[mkaply]

Do you mind if I take off the security flag on that? Doesn't seem to be needed.

[Sunyix11]

Of course, please remove it. Thank you

[Sunyix11]

Hi,

I would like to disable the QUIC protocol in Firefox with Intune policy.
Could you please help me how can I perform it?

Thank You in advance!

[mkaply]

Are you currently using policy? You can disable QUIC using the Preferences policy:

https://mozilla.github.io/policy-templates/#preferences

and setting the value:

network.http.http3.enabled.

to false

See:

https://support.mozilla.org/ml/questions/1408003

[Sunyix11]

Yes, We are using Intune policy for Firefox configuration. We already have a preferences - OMA URI setting, where we config 3-4 things.
So I will add the following to the exisitng preferences intune policy:

"network.http.http3.enable": {
"Value": false,
"Status": “default”
},

Thank you for your fast response

[Sunyix11]

I added to the existing preferences intune policy the quic protocol disable config like this:

<enabled/> <data id="JSON" value=' { "layout.spellcheckDefault": { "Value": 1, "Status": "default" }, "browser.tabs.closeWindowWithLastTab": { "Value": false, "Status": "default" }, "network.http.http3.enable": { "Value": false, "Status": “default” }, "browser.safebrowsing.malware_enabled": { "Value": true, "Status": "default" } }'/>

but I got the following policy error on the test device: "Unable to parse JSON for Preferences."
Could you please help me where did I go wrong? I double checked but did not find any typo.

[mkaply]

For default, those aren't double quotes, those are "Smart quotes" I usually paste things into jsonlint.com and it shows it to me.

[Sunyix11]

Thank you for the hint. I checked jsonlint.com and show that there is "Parse error on line 1:"
But I do not understand because currently this code is working fine:

<enabled/> <data id="JSON" value=' { "layout.spellcheckDefault": { "Value": 1, "Status": "default" }, "browser.tabs.closeWindowWithLastTab": { "Value": false, "Status": "default" }, "browser.safebrowsing.malware_enabled": { "Value": true, "Status": "default" } }'/>:

I just add the QUIC protocol disable part and now it is not working. :(

[mkaply]

The JSON part parses fine.

{ "layout.spellcheckDefault": { "Value": 1, "Status": "default" }, "browser.tabs.closeWindowWithLastTab": { "Value": false, "Status": "default" }, "browser.safebrowsing.malware_enabled": { "Value": true, "Status": "default" } }

I think you might need to remove the extra space here:

value=' {

[Sunyix11]

Hi,

I found the problem. One of the quotation mark was different: “default”
Now, it is working fine.
Thank you for your hints and help