Dear Firefox Support Team,
We are evaluating the deployment of Mozilla Firefox Group Policy templates in our organization to support Microsoft Defender for Endpoint Netw… (čitajće wjace)
Dear Firefox Support Team,
We are evaluating the deployment of Mozilla Firefox Group Policy templates in our organization to support Microsoft Defender for Endpoint Network Protection.
Microsoft has advised us that, for custom URL/domain Indicators to work correctly in Firefox, we need to:
1. Download the Firefox policy templates from:
https://github.com/mozilla/policy-templates/releases
2. Copy the files and folders under the Windows directory to:
`C:\Windows\PolicyDefinitions`
3. Enable the **Disable Encrypted Client Hello** policy.
4. Configure the following preference to disable HTTP/3:
```json
{
"network.http.http3.enable": {
"Value": false,
"Status": "default"
}
}
```
Microsoft referred us to Mozilla for clarification regarding the lifecycle, compatibility and rollback of the Firefox policy templates. Before deploying the configuration across our managed Windows devices, we would appreciate your guidance on the following questions.
1. Policy template update frequency
We noticed that new versions of the Firefox policy templates are released quite frequently.
- Is it necessary to deploy every new version of the policy templates?
- Should organizations establish a regular schedule for updating the ADMX/ADML files?
- Alternatively, should the templates only be updated when a required policy has changed or when the installed Firefox version requires a newer template?
- Is there a recommended method for matching a policy-template version with Firefox Release and Firefox ESR versions?
- Could an older policy-template version continue to be used if it already contains the required policies?
2. Different Firefox versions across endpoints
Our users may have different versions of Firefox or Firefox ESR installed.
If the same policy templates and settings are deployed to all managed Windows devices:
- What happens when an installed Firefox version does not support a setting included in the policy template?
- Will Firefox simply ignore an unsupported policy, or could it cause policy-processing errors or browser compatibility issues?
- Is there a minimum supported Firefox or Firefox ESR version for `DisableEncryptedClientHello` and the `network.http.http3.enable` preference?
- Do you recommend targeting the deployment according to the installed Firefox version?
3. Devices without Firefox installed
Some managed devices do not have Firefox installed.
- Is it safe to deploy the Firefox ADMX/ADML files and related registry-based policy settings to those devices?
- Will the files and settings remain inactive until Firefox is installed?
- Could deploying the templates or registry settings have any effect on Windows or other browsers?
4. Replacement of existing templates
When copying the files into `C:\Windows\PolicyDefinitions`, Windows may prompt us to replace existing Mozilla ADMX/ADML files.
- Is it safe to replace older versions with the latest released templates?
- Could replacement affect or remove existing Firefox Group Policy configurations?
- Should the existing files be backed up before replacement?
- Do we only need `mozilla.admx`, `firefox.admx` and the corresponding language-specific ADML files, or should every file and language folder in the Windows package be copied?
5. Rollback procedure
If the deployment causes an unexpected browser, compatibility or performance issue, what is Mozilla’s recommended rollback procedure?
Should we:
- Change **Disable Encrypted Client Hello** to *Not Configured* or *Disabled*;
- Remove or reverse the `network.http.http3.enable` preference;
- Remove the associated Firefox policy registry values;
- Restore the previous ADMX/ADML files; and/or
- Remove the current templates from `C:\Windows\PolicyDefinitions`?
Please clarify whether withdrawing the Group Policy assignment is sufficient to restore Firefox’s default ECH and HTTP/3 behavior, or whether endpoint-level cleanup is also required.
6. Recommended enterprise deployment approach
For a managed enterprise environment, would Mozilla recommend deploying these templates through:
- The Active Directory Group Policy Central Store;
- Local `C:\Windows\PolicyDefinitions`;
- Microsoft Intune ADMX ingestion;
- Direct registry-based policies; or
- Another supported method?
We would appreciate Mozilla’s official recommendation so that we can complete our internal risk assessment and prepare an appropriate deployment, maintenance and rollback plan.
Thank you for your assistance.
Best regards,
Summer
