We recommend keeping automatic updates enabled for all Firefox deployments to ensure that the latest security patches are applied and all features are available, but your specific environment may prevent automatic updates.

Both Firefox Rapid Release and Firefox Extended Support Release can be used in your Enterprise environments. If you're concerned about frequent large updates, we recommend checking out Choose a Firefox update channel to learn more about Firefox Extended Support Release.

Disable Firefox updates

Automatic updates are enabled by default, but you can disable them using the DisableAppUpdate policy.

When updates are enabled, they can be installed silently without user approval by enabling the AppAutoUpdate policy.

Troubleshooting Firefox update issues

If a workstation does not receive Firefox updates, the following PowerShell checks can help identify the root cause.

Check local Group Policy (GPO) registry keys

Run the following command:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Mozilla\Firefox" | 
Select-Object DisableAppUpdate, AppAutoUpdate

Expected values:

If these values are not set as expected, Firefox updates may be disabled by local or domain Group Policy.

Check the installed Firefox version

Run the following PowerShell command:

Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" |
Where-Object { $_.PSChildName -like "Mozilla Firefox*" } |
ForEach-Object {
    Get-ItemProperty $_.PsPath |
    Select-Object DisplayName, DisplayVersion, Publisher, InstallDate
}

Compare the installed version with the latest Firefox ESR version available on Mozilla’s website.

Check the scheduled task

Firefox relies on a background scheduled task to download and apply updates.

Run the following PowerShell command:

Get-ScheduledTask | 
Where-Object { $_.TaskName -like "*Firefox Background Update*" } | 
ForEach-Object { Get-ScheduledTaskInfo $_ }

-> Ensure that:

• The task exists
• The task is enabled
• The task runs successfully without errors

Check Mozilla Maintenance Service

On Windows, Firefox updates may require the Mozilla Maintenance Service to be installed and running. This service allows Firefox to apply updates without requiring administrative privileges.

Check if the service exists and its status

Run the following PowerShell command:

Get-Service -Name MozillaMaintenance -ErrorAction SilentlyContinue |
Select-Object Name, DisplayName, Status, StartType

-> Expected behavior:

• The service exists
• Status is Running (or Stopped, but able to start)
• StartType is set to Automatic or Manual
• If the service is missing, Firefox may not be able to apply updates automatically.

Start the service manually (if required)

If the service exists but is not running, try starting it. Run the following PowerShell command:

Start-Service -Name MozillaMaintenance

Check again that the service starts without errors.

Reinstall the Mozilla Maintenance Service

If the service is missing or corrupted, it can be reinstalled using the Firefox installer:

1. Download the Firefox installer matching your deployment (ESR or standard release).
2. Run the installer as Administrator.
3. Ensure that Install Mozilla Maintenance Service is selected.

After installation, recheck the service status.

UAC prompt asking for administrator credentials during updates

On some workstations, an update triggers a UAC prompt titled Firefox Updater Software asking for administrator credentials, even though the Mozilla Maintenance Service is installed and healthy. Standard users cannot complete the update and the prompt reappears at every Firefox launch.

Cause

Before using the Maintenance Service, the Firefox updater checks the UAC configuration of the workstation (IsUnpromptedElevation test in the updater source code). If UAC is configured for silent elevation, Firefox assumes that elevation will happen without any prompt — as it would for an administrator — and skips the Maintenance Service. But if the logged-in user is not actually an administrator, elevation is not silent and Windows displays a UAC credential prompt instead.

This happens only when all three of the following conditions are met:

1. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin is set to 0 (security option User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode = Elevate without prompting; Windows default is 5)
2. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop is set to 0 (security option User Account Control: Switch to the secure desktop when prompting for elevation = Disabled; Windows default is 1)
3. The logged-in user has a UAC filtered token: member of a privileged group (Administrators, Backup Operators, Power Users, etc.), including groups marked deny-only, or holder of sensitive privileges (such as SeBackupPrivilege or SeDebugPrivilege) granted through Group Policy. Note that privilege-based filtering is not visible in whoami /groups.

Diagnosis

Check the updater log for the following signature:

Get-Content "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\*\updates\0\update.log"

...
After checking IsUnpromptedElevation, useService=false
Elevating via a UAC prompt
Writing status to file: failed: 9
...

The useService=false line after the IsUnpromptedElevation check confirms this cause (error 9 means the user canceled the UAC prompt). Note: after a first failure, subsequent logs show useService=false from the first line, without the After checking... lines (residual state, see Solution).

Then check the UAC values and the pending update status:

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop
Get-Content "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\*\updates\0\update.status"

Possible update.status values:

Solution

1. Close Firefox.

2. Run the following commands in an elevated PowerShell:

# Restore the default UAC elevation prompt behavior for administrators
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 5 /f
# Re-enable the secure desktop for elevation prompts
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 1 /f
# Clear the residual update state (otherwise the prompt appears one last time)
Remove-Item "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\*\*" -Recurse -Force

3. Start Firefox, go to Help > About Firefox and wait for Restart to Update Firefox.

4. Restart Firefox: the update must be applied without any UAC prompt.

-> Notes:

• Restoring either one of the two UAC values is enough to break the faulty condition; restoring both brings the workstation back to Windows defaults.
• If these UAC values are enforced by a domain Group Policy, they will be reset at the next policy refresh (check with gpupdate /force) — the fix must then be applied at the GPO level.
• Alternatively, removing the user from the privileged group (then logging off and back on) also resolves the issue.

Verification

After the update, the new update.log contains After checking IsUnpromptedElevation, useService=true and update.status shows applied-service.

Check BITS transfers (Background Intelligent Transfer Service)

Firefox uses BITS to download updates in the background.

Run the following PowerShell command:

Get-BitsTransfer | 
Where-Object { $_.DisplayName -match 'mozilla' -or $_.RemoteName -match 'mozilla' } | 
ForEach-Object {
    $job = $_
    foreach ($file in $job.FileList) {
        [PSCustomObject]@{
            DisplayName        = $job.DisplayName
            JobState           = $job.JobState
            BytesTransferredMB = [math]::Round($file.BytesTransferred / 1MB, 2)
            BytesRemainingMB   = [math]::Round(($file.BytesTotal - $file.BytesTransferred) / 1MB, 2)
            ProgressPercent    = if ($file.BytesTotal -gt 0) { 
                                     [math]::Round(($file.BytesTransferred / $file.BytesTotal * 100), 2) 
                                 } else { 0 }
            RemoteURL          = $file.RemoteName
            LocalPath          = $file.LocalName
        }
    }
}

-> What to check

• JobState shows the current transfer state (transferring, suspended, completed, or error).
• ProgressPercent indicates download progress.
• RemoteURL shows the URL used by Firefox to retrieve the update.

-> If the download is blocked

If progress does not advance or the job fails, verify that the URL shown in RemoteURL is not blocked by your network, firewall, or proxy.

To confirm, copy and paste the URL into a browser and check whether the download starts successfully.

List Firefox-related files in C:\ProgramData

Firefox update files are downloaded and stored in the following location.

Run the following PowerShell command:

Get-ChildItem -Path "C:\ProgramData\Mozilla-*" -Recurse | 
Select-Object @{ Name="Path"; Expression={$_.FullName} }, 
              @{ Name="Type"; Expression={ if ($_.PSIsContainer) { "Directory" } else { "File" } } }, 
              @{ Name="Size"; Expression={$_.Length} },
              @{ Name="LastModified"; Expression={$_.LastWriteTime} 
}

This helps verify whether update files were downloaded and identify incomplete or stalled files.