<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Mike, Valtori,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I don’t think I’m aware of any 3<sup>rd</sup> party GPO admin templates that have settings that can be merged/appended across multiple links like parent/child
OUs. It’s possible it may natively exist though, I’m just not aware of something that works that way with admin templates. I assume it exists for non-admin template GPO settings… like the IE site-to-zone assignment lists that Valtori mentioned. Getting
multi-value GPO settings and nested OUs to “merge” settings seems to always be a pain point for our team. We typically have organizational GPOs with settings that are ‘site-wide’. If any department or specific location (OU) then wants “extra” multi-value
settings appended, we typically clone the parent GPO and just add to the child GPO. This works fine most of the time until we need to add more values to a multi-value setting. In this case we need to revisit all those cloned child GPOs and adjust those accordingly
too.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">As a workaround, I guess it’s possible to create “extra” GPO settings that Firefox can choose to internally merge/append (or replace) itself. Such as:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Mozilla</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Firefox</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Popups</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Allowed
Sites (popup URL string list)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Mozilla</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Firefox</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Popups</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Allowed
Sites_2 (popup URL string list)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Mozilla</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Firefox</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Popups</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Allowed
Sites_2_ReplaceMode: <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> Not Configured/Disabled: Defaults to MERGE with “Allowed Sites” above<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> Enabled: REPLACE “Allowed Sites”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Mozilla</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Firefox</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Popups</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Allowed
Sites_3 (popup URL string list)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Mozilla</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Firefox</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Popups</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Allowed
Sites_3_ReplaceMode<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> Not Configured/Disabled: Defaults to MERGE with “Allowed Sites”, “Allowed Sites_2”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> Enabled: REPLACE “Allowed Sites” and/or “Allowed Sites_2”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">It’s messy but should work. If this road gets traveled, I’m just not sure how many “levels” any multi-value settings should have. In the example above, it’s
just the main setting plus two additional. A 2-deep setting would probably suffice for us, but maybe an extra 3<sup>rd</sup> (or more) could be useful to others?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D">--<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Scott Copus, Desktop Support Systems Engineer<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Information Technology Services | Western Kentucky University<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="https://www.wku.edu/its"><span style="color:#0563C1">https://www.wku.edu/its</span></a>
<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Enterprise [mailto:enterprise-bounces@mozilla.org]
<b>On Behalf Of </b>Mike Kaply<br>
<b>Sent:</b> Thursday, August 08, 2019 11:41 AM<br>
<b>To:</b> Valtori OTTK Elinkaaripalvelut <elinkaaripalvelut.ottk@valtori.fi><br>
<b>Cc:</b> enterprise@mozilla.org<br>
<b>Subject:</b> Re: [Mozilla Enterprise] GPO setting lists are not appending<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" align="center" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:center;line-height:12.0pt;background:#FFEB9C">
<b><span style="font-size:10.0pt;color:#9C6500">** This message originated from outside WKU. Always use caution following links. **</span></b><o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal">I'm not sure what we would be doing to affect this.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I just did a quick check with machine and user policies on Chrome, and policies aren't combined/appended, machine replaces user.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm not sure how this should work with OUs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If anyone has any ideas about this, I would appreciate it.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Mike<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Thu, Aug 8, 2019 at 7:48 AM Valtori OTTK Elinkaaripalvelut <<a href="mailto:elinkaaripalvelut.ottk@valtori.fi">elinkaaripalvelut.ottk@valtori.fi</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">Hello<br>
<br>
Have anyone noticed that if two GPOs have for example NTLM list , only list of last processed GPO applies?<br>
<br>
Makes managing in OU level bit hard. Top level GPO settings have to be copied to sub level GPO settings, if customer wants own trust and every sub level GPO have to be updated if top level GPO is updated. Not familiar with ADMX-files but at least Internet Explorer
Site-to-zone settings are appending.<br>
<br>
Thanks<br>
- Miika Sorvisto<br>
<br>
<o:p></o:p></p>
</blockquote>
</div>
</div>
</div>
</body>
</html>