Questions About Enterprise Deployment, Updating and Rollback of Firefox Policy Templates
Dear Firefox Support Team,
We are evaluating the deployment of Mozilla Firefox Group Policy templates in our organization to support Microsoft Defender for Endpoint Network Protection.
Microsoft has advised us that, for custom URL/domain Indicators to work correctly in Firefox, we need to:
1. Download the Firefox policy templates from:
https://github.com/mozilla/policy-templates/releases
2. Copy the files and folders under the Windows directory to:
`C:\Windows\PolicyDefinitions`
3. Enable the **Disable Encrypted Client Hello** policy.
4. Configure the following preference to disable HTTP/3:
```json {
"network.http.http3.enable": {
"Value": false,
"Status": "default"
}
} ```
Microsoft referred us to Mozilla for clarification regarding the lifecycle, compatibility and rollback of the Firefox policy templates. Before deploying the configuration across our managed Windows devices, we would appreciate your guidance on the following questions.
1. Policy template update frequency
We noticed that new versions of the Firefox policy templates are released quite frequently.
- Is it necessary to deploy every new version of the policy templates?
- Should organizations establish a regular schedule for updating the ADMX/ADML files?
- Alternatively, should the templates only be updated when a required policy has changed or when the installed Firefox version requires a newer template?
- Is there a recommended method for matching a policy-template version with Firefox Release and Firefox ESR versions?
- Could an older policy-template version continue to be used if it already contains the required policies?
2. Different Firefox versions across endpoints
Our users may have different versions of Firefox or Firefox ESR installed.
If the same policy templates and settings are deployed to all managed Windows devices:
- What happens when an installed Firefox version does not support a setting included in the policy template?
- Will Firefox simply ignore an unsupported policy, or could it cause policy-processing errors or browser compatibility issues?
- Is there a minimum supported Firefox or Firefox ESR version for `DisableEncryptedClientHello` and the `network.http.http3.enable` preference?
- Do you recommend targeting the deployment according to the installed Firefox version?
3. Devices without Firefox installed
Some managed devices do not have Firefox installed.
- Is it safe to deploy the Firefox ADMX/ADML files and related registry-based policy settings to those devices?
- Will the files and settings remain inactive until Firefox is installed?
- Could deploying the templates or registry settings have any effect on Windows or other browsers?
4. Replacement of existing templates
When copying the files into `C:\Windows\PolicyDefinitions`, Windows may prompt us to replace existing Mozilla ADMX/ADML files.
- Is it safe to replace older versions with the latest released templates?
- Could replacement affect or remove existing Firefox Group Policy configurations?
- Should the existing files be backed up before replacement?
- Do we only need `mozilla.admx`, `firefox.admx` and the corresponding language-specific ADML files, or should every file and language folder in the Windows package be copied?
5. Rollback procedure
If the deployment causes an unexpected browser, compatibility or performance issue, what is Mozilla’s recommended rollback procedure?
Should we:
- Change **Disable Encrypted Client Hello** to *Not Configured* or *Disabled*;
- Remove or reverse the `network.http.http3.enable` preference;
- Remove the associated Firefox policy registry values;
- Restore the previous ADMX/ADML files; and/or
- Remove the current templates from `C:\Windows\PolicyDefinitions`?
Please clarify whether withdrawing the Group Policy assignment is sufficient to restore Firefox’s default ECH and HTTP/3 behavior, or whether endpoint-level cleanup is also required.
6. Recommended enterprise deployment approach
For a managed enterprise environment, would Mozilla recommend deploying these templates through:
- The Active Directory Group Policy Central Store;
- Local `C:\Windows\PolicyDefinitions`;
- Microsoft Intune ADMX ingestion;
- Direct registry-based policies; or
- Another supported method?
We would appreciate Mozilla’s official recommendation so that we can complete our internal risk assessment and prepare an appropriate deployment, maintenance and rollback plan.
Thank you for your assistance.
Best regards, Summer
Všetky odpovede (2)
Hi Summer,
I've forwarded your question internally so please bear with us a bit more.
I'm sorry, I keep putting off replying to this because it's so long with so many questions.
I'll try to answer each question.
> Is it necessary to deploy every new version of the policy templates?
No. You only need to update if there is a new policy you want.
> Should organizations establish a regular schedule for updating the ADMX/ADML files?
We recommend that, but Microsoft doesn't make this easy on Intune especially. It's difficult to update to a new ADMX file without removing the template from existing users.
If you are using local group policy, there's no issue.
> Alternatively, should the templates only be updated when a required policy has changed or when the installed Firefox version requires a newer template?
That's my recommendation.
> Is there a recommended method for matching a policy-template version with Firefox Release and Firefox ESR versions?
There is not (and we actively stopped doing this). We never remove a policy from the template, so you can always use the latest version with any Firefox or Firefox ESR.
The reason we stopped mapping them is because we've moved to two week release cycles with regular Firefox and we don't want to release unnecessary updates to the templates.
When we release new policies, we do indicate which version of Firefox they correspond to and we do mark policies as working with a particular version.
> Could an older policy-template version continue to be used if it already contains the required policies?
Absolutely.
> What happens when an installed Firefox version does not support a setting included in the policy template? >Will Firefox simply ignore an unsupported policy, or could it cause policy-processing errors or browser compatibility issues?
It will just ignore it.
> Is there a minimum supported Firefox or Firefox ESR version for `DisableEncryptedClientHello` and the `network.http.http3.enable` preference?
The DisableEncryptedClientHello policy goes back to Firefox 127. The preferences goes ever further.
> Do you recommend targeting the deployment according to the installed Firefox version?
I do not. The policies are designed to work with any version of Firefox.
> Is it safe to replace older versions with the latest released templates?
Yes, we do not remove policies from the template, we mark them as deprecated in the UI.
In cases where we move things in the UI, we keep both versions for quite a while do it's easy to migrate, but this shouldn't happen again anytime soon.
> Could replacement affect or remove existing Firefox Group Policy configurations?
No, it shouldn't affect existing configurations since the registry entries stay the same.
> Should the existing files be backed up before replacement?
That's up to you. All of the files are in github.
> Do we only need `mozilla.admx`, `firefox.admx` and the corresponding language-specific ADML files, or should every file and language folder in the Windows package be copied?
You only need those two admx files and the corresponding language files.
> Should we:
> Change **Disable Encrypted Client Hello** to *Not Configured* or *Disabled*; > Remove or reverse the `network.http.http3.enable` preference; > Remove the associated Firefox policy registry values; > Restore the previous ADMX/ADML files; and/or > Remove the current templates from `C:\Windows\PolicyDefinitions`?
> Please clarify whether withdrawing the Group Policy assignment is sufficient to restore Firefox’s default ECH and HTTP/3 behavior, or whether endpoint-level cleanup is also required.
It should be enough to just change the Disable Encrypted Hello policy. The policy is read at startup and the change is only made if the policy is there.
> For a managed enterprise environment, would Mozilla recommend deploying these templates through:
> The Active Directory Group Policy Central Store; > Local `C:\Windows\PolicyDefinitions`; > Microsoft Intune ADMX ingestion; > Direct registry-based policies; or > Another supported method?
I don't recommend Intune right now simply because it's very difficult to version ADMX templates.
The simplest way would be to just set a value in the registry for the policy if you could do that easily.
I'm more than happy to have a further discussion on this topic in a meeting if necessary. Feel free to reach out to mkaply at mozilla.com.
Ak chcete odpovedať na príspevky, musíte sa prihlásiť do svojho účtu. Ak ešte nemáte účet, položte novú otázku.