Firefox Enterprise Community Forum

Dear Firefox Support Team,

We are evaluating the deployment of Mozilla Firefox Group Policy templates in our organization to support Microsoft Defender for Endpoint Network Protection.

Microsoft has advised us that, for custom URL/domain Indicators to work correctly in Firefox, we need to:

1. Download the Firefox policy templates from:

  https://github.com/mozilla/policy-templates/releases

2. Copy the files and folders under the Windows directory to:

  `C:\Windows\PolicyDefinitions`

3. Enable the **Disable Encrypted Client Hello** policy.

4. Configure the following preference to disable HTTP/3:

```json {

 "network.http.http3.enable": {
   "Value": false,
   "Status": "default"
 }

} ```

Microsoft referred us to Mozilla for clarification regarding the lifecycle, compatibility and rollback of the Firefox policy templates. Before deploying the configuration across our managed Windows devices, we would appreciate your guidance on the following questions.

1. Policy template update frequency

We noticed that new versions of the Firefox policy templates are released quite frequently.

• Is it necessary to deploy every new version of the policy templates?
• Should organizations establish a regular schedule for updating the ADMX/ADML files?
• Alternatively, should the templates only be updated when a required policy has changed or when the installed Firefox version requires a newer template?
• Is there a recommended method for matching a policy-template version with Firefox Release and Firefox ESR versions?
• Could an older policy-template version continue to be used if it already contains the required policies?

2. Different Firefox versions across endpoints

Our users may have different versions of Firefox or Firefox ESR installed.

If the same policy templates and settings are deployed to all managed Windows devices:

• What happens when an installed Firefox version does not support a setting included in the policy template?
• Will Firefox simply ignore an unsupported policy, or could it cause policy-processing errors or browser compatibility issues?
• Is there a minimum supported Firefox or Firefox ESR version for `DisableEncryptedClientHello` and the `network.http.http3.enable` preference?
• Do you recommend targeting the deployment according to the installed Firefox version?

3. Devices without Firefox installed

Some managed devices do not have Firefox installed.

• Is it safe to deploy the Firefox ADMX/ADML files and related registry-based policy settings to those devices?
• Will the files and settings remain inactive until Firefox is installed?
• Could deploying the templates or registry settings have any effect on Windows or other browsers?

4. Replacement of existing templates

When copying the files into `C:\Windows\PolicyDefinitions`, Windows may prompt us to replace existing Mozilla ADMX/ADML files.

• Is it safe to replace older versions with the latest released templates?
• Could replacement affect or remove existing Firefox Group Policy configurations?
• Should the existing files be backed up before replacement?
• Do we only need `mozilla.admx`, `firefox.admx` and the corresponding language-specific ADML files, or should every file and language folder in the Windows package be copied?

5. Rollback procedure

If the deployment causes an unexpected browser, compatibility or performance issue, what is Mozilla’s recommended rollback procedure?

Should we:

• Change **Disable Encrypted Client Hello** to *Not Configured* or *Disabled*;
• Remove or reverse the `network.http.http3.enable` preference;
• Remove the associated Firefox policy registry values;
• Restore the previous ADMX/ADML files; and/or
• Remove the current templates from `C:\Windows\PolicyDefinitions`?

Please clarify whether withdrawing the Group Policy assignment is sufficient to restore Firefox’s default ECH and HTTP/3 behavior, or whether endpoint-level cleanup is also required.

6. Recommended enterprise deployment approach

For a managed enterprise environment, would Mozilla recommend deploying these templates through:

• The Active Directory Group Policy Central Store;
• Local `C:\Windows\PolicyDefinitions`;
• Microsoft Intune ADMX ingestion;
• Direct registry-based policies; or
• Another supported method?

We would appreciate Mozilla’s official recommendation so that we can complete our internal risk assessment and prepare an appropriate deployment, maintenance and rollback plan.

Thank you for your assistance.

Best regards, Summer

I have Mozilla Firefox and Mozilla ESR browsers updates to manage across the devices. Policies have been configured on browser from Intune and same has been reflected everywhere in registry, and update.json file. still task is missing. can someone help on this. Also i have few ESR so will same ADMX file will work for that?

Hi all,

We use a service integration in our organization that only works in the latest ESR version of Firefox (140.14). The latest regular release breaks our integration due to added security policies preventing the software from communicating with Windows services.

After installing the ESR version and disabling auto updates in the settings and adding the DisableAppUpdate registry key, the software still keeps updating to 154 (not the ESR version). I've also chosen to not install the Mozilla Maintenance service when installing the ESR version. I can't seem to find any support articles of people having the same issue. Is there something I may be missing? Any help would be greatly appreciated.

Hello, we have the issue, that Firefox esr 153.1.0 crashes on opening urls. The crashes happen on several devices. These are the current crash-reports: bp-3e6bd41b-89b0-4a49-9479-90cbc0260831 bp-9bd858e0-2573-4a01-8bac-90c320260831 bp-ad358921-a24d-4e02-9ed5-2bc4d0260831 bp-0bfb15d0-b637-48b6-a445-94b350260831 bp-0dc0dbcb-fb77-4ce6-a1c0-659f40260831 bp-268bf05a-3eb7-493e-bd40-42e0c0260831 bp-3910ddb1-9dbd-4016-b421-0dd450260831

thanks for Help and advice.

Best Regards

Felix

Hi,

In the latest firefox update 154, no start pages are displayed that were distributed with a registry key via group policy. It only works again if you change this setting manually in the Firefox settings.

In Version 153 it´s fine.

Jan

Hallo, my setup is some server (keycloak) with mTLS needing keypairs just for allowance for the machines in the enterprise. But as far as i know, i need to setup personal keypairs for the users, not just the machines. How do i push a ".p12" keypair into the browsers trust stores? Is there a way via GPOs? As far as i have read the https://firefox-admin-docs.mozilla.org/reference/policies/, there is no support for ".p12" files?

The only way i got told from AI is via a script. If i could just stuff that ".p12" file into some place in the GPO, i would be perfectly happy... (?)

I don't understand why auto:config is so difficult (for me at least) to create. Isn't there an easier way? I've tried following the directions and creating the 2 files. But I can't manage to successfully create auto:config.

I created and pasted the first tile into the prefs folder. For the 2nd, I noticed the firefox.cfg file I created in Notepad appended a .txt suffix. I pasted it into the Firefox top directory. Then typed auto:config into the address bar. Nothing happened. Can anyone tell what I did wrong? Is the .txt suffix not recognized? Or is there's an easier way to do this?

We are managing Firefox settings using Intune via Imported ADMX templates.

We are managing Extension Settings via 'Extension Management (JSON on one line)' which works fine for our force installs, force removals etc.

We have noticed that some users have installed 3rd party extensions which create the ExtensionSettings key in the registry with the 3rd party extension details.

The issue we see if when ExtensionSettings exists as a REG_SZ or REG_MULTI_SZ under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox` it is then ignored if the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\ExtensionSettings` key exists.

Is there a setting we can use to have these settings merged by Firefox or have the REG_SZ/REG_MULTI_SZ take priority or is the only way to ensure enterprise policy continues to work we need to migrate our extension settings into the key rather than string?

Thanks!

I'm trying to get the Enterprise Release Notes for Firefox 148 and 149. They seem to be the only ones missing from 141 to 151 inclusive. It appears the URL for the notes is in the format https://support.mozilla.org/en-US/kb/firefox-enterprise-###-release-notes/, where ### is the version. For these two versions, I get a "Page Not Found" error.

I have tried finding them through the Firefox Release Calendar (https://whattrainisitnow.com/calendar/). If you click on the link to expand previous releases and then click on a release version number, the page that comes up has links to the three different versions of release notes. Enterprise shows a link for the two missing versions in the same format as I have noted above.

I have also tried https://support.mozilla.org/en-US/products/firefox-enterprise/whats-new-firefox-enterprise and it lists quite a few versions but 148 and 149 are missing in action.

we are using firefox std version in more than 15000 machines in our organisation, recentlty we migrated to all machines to ESR version, but now we are getting escallation, the application working very slow and not opening sometimes

I don't know if feature requests should be made here or elsewhere, but both chrome & edge have policies to force safe search in google (and bing in edge) in addition to a policy to force restricted mode in youtube, so I wish these get added to firefox.

Also, there is no policy to block firefox task manager (about:processes). I don't know if it's a security vulnerability to add it or not.

Is there a blessed solution to the problem above? I'm sure we're not alone, but our end users are not admins. God forbid... So the official statement of "enter admin credentials" is not a plausable solution on managed systems. Providing a Reinstall Firefox on the users' selv service store is something we can do, but users are usually not fond of losing browser data. (I do konw about Firefox account to sync/restore) My question is more like as the problem roots back to permission problems, what would be the proper command(s) to fix permissions? I can run commands on the end users' comptuers in the background, as root/system user, or even as them of course. Thanks

Moderator note: Moved from the Firefox Desktop forum to the Firefox for Enterprise forum.