Hi everyone,
I am deploying Firefox Enterprise (MSI) in an Active Directory Domain environment via corporate OS deployment images.
I am reporting a severe issue with rece… (saiba mais)
Hi everyone,
I am deploying Firefox Enterprise (MSI) in an Active Directory Domain environment via corporate OS deployment images.
I am reporting a severe issue with recent versions regarding the "Open Firefox automatically when your computer starts" feature. The browser is forcing this behavior globally on new profiles without any user opt-in or consent, which violates standard enterprise deployment principles.
The Behavior:
A fresh installation of the Firefox Enterprise MSI is performed.
A new Active Directory user logs onto the workstation and opens Firefox for the very first time.
Completely silently, Firefox writes a randomized hash entry to the user's startup registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run -> Mozilla-Firefox-XXXXXXXX with the -os-autostart argument.
If you check the Firefox settings UI, the option "Open Firefox automatically when your computer starts up" is checked by default.
Why this is an Enterprise Deployment Issue:
Bypasses corporate control: In a managed environment, we cannot have web browsers arbitrarily adding themselves to the Windows startup sequence. It degrades logon performance, increases memory overhead on VDI/Terminal Services, and disrupts change management.
Breaks policies.json / HKLM GPO constraints: Even if we attempt to lock this setting down using browser.startup.windowsLaunchOnLogin.enabled = false or disableCreation = true via enterprise policies, Firefox seems to run the registry injection routine before reading or honoring the enterprise policy framework on the very first execution.
Winget updates make it worse: When winget upgrade updates the browser, it purges the local distribution/policies.json file, triggering this forced injection behavior all over again on subsequent launches.
Steps to Reproduce:
Install Firefox Enterprise MSI on a clean Windows machine.
Log in as a new user (who has no pre-existing Firefox profile data).
Launch Firefox once and close it.
Check HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The Mozilla-Firefox-XXXXXXXX string is present without the user ever clicking an opt-in prompt.
Expected Behavior:
Firefox Enterprise should never opt-in to startup tasks automatically. The default state for browser.startup.windowsLaunchOnLogin.enabled must be false in the Enterprise MSI installer, or at the very least, it should strictly respect the GPO/policies.json barrier prior to interacting with the Windows HKCU registry.
Is this an intentional behavior change in the current lifecycle, or a regression bug in the MSI installer's initialization code?
Thanks!