Firefox Enterprise Community Forum

Dear Firefox Support Team,

We are evaluating the deployment of Mozilla Firefox Group Policy templates in our organization to support Microsoft Defender for Endpoint Network Protection.

Microsoft has advised us that, for custom URL/domain Indicators to work correctly in Firefox, we need to:

1. Download the Firefox policy templates from:

  https://github.com/mozilla/policy-templates/releases

2. Copy the files and folders under the Windows directory to:

  `C:\Windows\PolicyDefinitions`

3. Enable the **Disable Encrypted Client Hello** policy.

4. Configure the following preference to disable HTTP/3:

```json {

 "network.http.http3.enable": {
   "Value": false,
   "Status": "default"
 }

} ```

Microsoft referred us to Mozilla for clarification regarding the lifecycle, compatibility and rollback of the Firefox policy templates. Before deploying the configuration across our managed Windows devices, we would appreciate your guidance on the following questions.

1. Policy template update frequency

We noticed that new versions of the Firefox policy templates are released quite frequently.

• Is it necessary to deploy every new version of the policy templates?
• Should organizations establish a regular schedule for updating the ADMX/ADML files?
• Alternatively, should the templates only be updated when a required policy has changed or when the installed Firefox version requires a newer template?
• Is there a recommended method for matching a policy-template version with Firefox Release and Firefox ESR versions?
• Could an older policy-template version continue to be used if it already contains the required policies?

2. Different Firefox versions across endpoints

Our users may have different versions of Firefox or Firefox ESR installed.

If the same policy templates and settings are deployed to all managed Windows devices:

• What happens when an installed Firefox version does not support a setting included in the policy template?
• Will Firefox simply ignore an unsupported policy, or could it cause policy-processing errors or browser compatibility issues?
• Is there a minimum supported Firefox or Firefox ESR version for `DisableEncryptedClientHello` and the `network.http.http3.enable` preference?
• Do you recommend targeting the deployment according to the installed Firefox version?

3. Devices without Firefox installed

Some managed devices do not have Firefox installed.

• Is it safe to deploy the Firefox ADMX/ADML files and related registry-based policy settings to those devices?
• Will the files and settings remain inactive until Firefox is installed?
• Could deploying the templates or registry settings have any effect on Windows or other browsers?

4. Replacement of existing templates

When copying the files into `C:\Windows\PolicyDefinitions`, Windows may prompt us to replace existing Mozilla ADMX/ADML files.

• Is it safe to replace older versions with the latest released templates?
• Could replacement affect or remove existing Firefox Group Policy configurations?
• Should the existing files be backed up before replacement?
• Do we only need `mozilla.admx`, `firefox.admx` and the corresponding language-specific ADML files, or should every file and language folder in the Windows package be copied?

5. Rollback procedure

If the deployment causes an unexpected browser, compatibility or performance issue, what is Mozilla’s recommended rollback procedure?

Should we:

• Change **Disable Encrypted Client Hello** to *Not Configured* or *Disabled*;
• Remove or reverse the `network.http.http3.enable` preference;
• Remove the associated Firefox policy registry values;
• Restore the previous ADMX/ADML files; and/or
• Remove the current templates from `C:\Windows\PolicyDefinitions`?

Please clarify whether withdrawing the Group Policy assignment is sufficient to restore Firefox’s default ECH and HTTP/3 behavior, or whether endpoint-level cleanup is also required.

6. Recommended enterprise deployment approach

For a managed enterprise environment, would Mozilla recommend deploying these templates through:

• The Active Directory Group Policy Central Store;
• Local `C:\Windows\PolicyDefinitions`;
• Microsoft Intune ADMX ingestion;
• Direct registry-based policies; or
• Another supported method?

We would appreciate Mozilla’s official recommendation so that we can complete our internal risk assessment and prepare an appropriate deployment, maintenance and rollback plan.

Thank you for your assistance.

Best regards, Summer

I am using Ubuntu Linux on a desktop PC running Firefox in kiosk mode going to a specific web page - Every time Firefox does an update (since version 147) the kiosk mode stops working. The very latest update, after a reboot, just shows the menu bars and not Firefox going to that specified web page. Has the kiosk code changed since v147 ?

Hi,

In the latest firefox update 154, no start pages are displayed that were distributed with a registry key via group policy. It only works again if you change this setting manually in the Firefox settings.

In Version 153 it´s fine.

Jan

I don't understand why auto:config is so difficult (for me at least) to create. Isn't there an easier way? I've tried following the directions and creating the 2 files. But I can't manage to successfully create auto:config.

I created and pasted the first tile into the prefs folder. For the 2nd, I noticed the firefox.cfg file I created in Notepad appended a .txt suffix. I pasted it into the Firefox top directory. Then typed auto:config into the address bar. Nothing happened. Can anyone tell what I did wrong? Is the .txt suffix not recognized? Or is there's an easier way to do this?

I don't know if feature requests should be made here or elsewhere, but both chrome & edge have policies to force safe search in google (and bing in edge) in addition to a policy to force restricted mode in youtube, so I wish these get added to firefox.

Also, there is no policy to block firefox task manager (about:processes). I don't know if it's a security vulnerability to add it or not.

I know nothing about the dev options for Internet settings and minor turned on and it says the remote server is set to production. No flipping idea what this is. Can somebody please help me?

This is a personal computer, not associated with any organization. I do not believe it to be necessary on this browser. If it is, please advise. If it is not necessary, please tell me how to disable,deactivate, or remove it. This message only appears in firefox. I don't know where it came from and therefore I do not trust it being there. If it was placed there BY fire fox, also please advise.

I am using Firefox as a multi-tab courseware viewer but need to block the user bringing up the Library page as then the user can see the courseware URL's - I am running it on AWS AppStream and can lock most features down., but this one eludes me - there seems to be no policy to block it. I have tried intercepting keystrokes at the GNOME level and autoconfig javascript to block keys. Is there a way to do this please? Blessings, Ian

Hello, For FF on Linux running in KIOSK mode, is there a way to allow the user to perform a refresh like you can do in normal mode by pressing F5 ? This seems to be disabled in KIOSK mode.

Thank you, Tom

Cree una política para filtrado web donde bloquea por ejemplo páginas de juegos de azar, sin embargo, varias páginas las está dejando abrir, para contrarestar eso, por medio de indicadores bloquee las páginas que deja pasar pero aún así está dejando abrir ciertas páginas, por ejemplo betplay, para solventar eso apliqué una política de filtrado web, para esto importé el admx de Mozilla, sin embargo en Mozilla todavía está dejando entrar a esa página.

Is there a way to push a policy that will allow device and apps and local netwrok access via MDM (https://support.mozilla.org/en-US/kb/control-personal-device-local-network-permissions-firefox)? We need to allow Firefox to access an app agent that is running on a device via localhost. We would like to do it with a macOS profile, Windows GPO and a json policy for linux. I can't seem to find this setting in policy templates.

Hello Everyone,

I am seeking assistance to configure Firefox browser so that internet access is blocked when the browser cannot download or access the proxy Auto-configuration (PAC) file. Our organisation enforces all web traffic through proxy servers defined by a PAC file. For compliance and security reasons, users should not have any direct internet access unless the browser is able to successfully retrieve and apply the PAC file.

The desired behaviour is:

1. Firefox attempts to download the PAC file from a defined URL. 2. If the PAC file is unreachable or fails to load (e.g., due to network restrictions or the device being outside the corporate network), Firefox should "fail closed" - meaning it should not allow any direct internet traffic. 3. This is effectively a "fail-block" mode: no fallback to direct connections, and no cached or bypassed proxy settings should allow internet browsing.

This behaviour is critical to prevent devices from accessing the internet without applying corporate proxy rules. I would like to know:

1/ Whether Firefox currently supports a setting or policy that enforces this fail-block condition when the PAC file is unavailable. 2/ If not, whether there are recommended configurations or enterprise policies (e.g., via `policies.json` or Group Policy templates) that could achieve equivalent enforcement.

Thank you for your assistance and guidance.

I want nothing to do with AI.

I have unticked perplexity.ai in preferences#search but every search from the search bar and address bar goes to perplexity.ai then immediately crashes and displays "Internal Error".

To use DDG I have to type duckduckgo.com on the address bar then search from there.

Firefox 140.4.0 ESR.

I've' scanned the PC with malwarebytes. I restored windows from a backup image I haven't made any changes to the PC at all. Was working fine in the AM but by later afternoon, it started using perplexity.ai exclusively.

How do I get rid of perplexity.ai

I have recently needed to update my motherboard, and the workshop put my C: and D: drives into an old second-hand motherboard they had. I have now checked Firefox - which was on my C: drive, and it works with all my old bookmarks. However I seem to now be part of an 'Enterprise', which I do not want. How do I get rid of my involvement with an Enterprise within Firefox? Thanks for your help. Kanga85