[Mozilla Enterprise] AutoConfig -> GPO/Policy, some things missing?

[Brian Mithen]

+1 on Scott's comment, as we also utilize Deep Freeze on our public PC's. If enabled, auto-update mechanisms on any software spend a lot of time spinning their wheels in update loops with no results.

On persistent desktops (e.g. staff) we allow updates (as long as the mechanism doesn't require admin rights) but that's a much smaller subset of users than the public machines.

--
Brian Mithen
Network & Systems Administrator
(785) 580-4610

Topeka and Shawnee County Public Library
1515 SW 10th Ave | Topeka, KS 66604-1374
tscpl.org

From: Copus, Scott [mailto:scott.copus at wku.edu]
Sent: Friday, November 9, 2018 10:50 AM
To: Mike Kaply <mkaply at mozilla.com>; Mozilla.org <enterprise at mozilla.org>
Subject: Re: [Mozilla Enterprise] AutoConfig -> GPO/Policy, some things missing?

Hi Mike,

I'm just following up on your comment about disabling extension updates.

In my environment we currently use a product called Deep Freeze on our university student labs and instructor computers. This software reverts all changes (by user or the OS) upon reboot. So having any software like Firefox or its plugins that automatically updates itself is futile in this situation. Instead we always disable all auto-updating mechanisms and instead push them via our client management system where we can wrap the updates around the process of disabling and re-enabling of Deep Freeze.

Another instance of where one might want a system to never automatically update itself is in non-persistent VDI environments.

If you look hard enough there's always a use case for anything out there. :)

Regards,
Scott

On Nov 9, 2018, at 8:13 AM, Mike Kaply <mkaply at mozilla.com<mailto:mkaply at mozilla.com>> wrote:
** This message originated from outside WKU. Always use caution following links. **
On Fri, Nov 9, 2018 at 4:53 AM, Marco Gaiarin <gaio at sv.lnf.it<mailto:gaio at sv.lnf.it>> wrote:
Mandi! Mike Kaply
  In chel di` si favelave...

>>     a)
>>      lockPref("extensions.update.enabled", false);
>>      lockPref("extensions.update.autoUpdateEnabled", false);
>>      lockPref("extensions.update.autoUpdateDefault", false);
> DisableAppUpdate policy

Ok. But the GPO are 'Disable system addons'?

Sorry, I misread that. We don't have a way to disable extension updates.

Why are you disabling extension updates? If an extension has an issue, you would want to get the update.


Generally, there's some (easy) way to map policy to GPO?
[a hint: why not to add simply Policy name in GPO description?]

This also seems related to:

>>     b)
>>      pref("extensions.autoDisableScopes", 8);
>>      pref("extensions.enabledScopes", 7);


so it is not clear if the policy disable addon updates or system addon
'tout-court'. ;-)

I don't know what that means.



>>     c)
>>      pref("plugin.state.flash", 2);
>>      pref("plugin.state.java", 2);
>>      pref("plugin.state.npcan", 2);
> Only flash is allowed with Firefox 60, so this isn't needed anymore.

OK. Good.

>>     d)
>>      pref("browser.disableResetPrompt", true);
> Yes. DisableProfileRefresh is the policy

Again, this is 'Disable profile recovery' in GPO?

The GPO is Disable Profile Refresh

https://github.com/mozilla/policy-templates/blob/master/windows/en-US/firefox.adml#L140



Thanks.

--
dott. Marco Gaiarin                                     GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''          http://www.lanostrafamiglia.it/
  Polo FVG   -   Via della Bontà, 7 - 33078   -   San Vito al Tagliamento (PN)
  marco.gaiarin(at)lanostrafamiglia.it<http://lanostrafamiglia.it>   t +39-0434-842711   f +39-0434-842797

                Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
      http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
        (cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

_______________________________________________
Enterprise mailing list
Enterprise at mozilla.org<mailto:Enterprise at mozilla.org>
https://mail.mozilla.org/listinfo/enterprise

To unsubscribe from this list, please visit https://mail.mozilla.org/listinfo/enterprise or send an email to enterprise-request at mozilla.org<mailto:enterprise-request at mozilla.org> with a subject of "unsubscribe"
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/enterprise/attachments/20181116/77f9bed1/attachment-0002.html>