<div dir="ltr"><div>I'm not sure what we would be doing to affect this.</div><div><br></div><div>I just did a quick check with machine and user policies on Chrome, and policies aren't combined/appended, machine replaces user.</div><div><br></div><div>I'm not sure how this should work with OUs.<br></div><div><br></div><div>If anyone has any ideas about this, I would appreciate it.</div><div><br></div><div>Mike<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Aug 8, 2019 at 7:48 AM Valtori OTTK Elinkaaripalvelut <<a href="mailto:elinkaaripalvelut.ottk@valtori.fi">elinkaaripalvelut.ottk@valtori.fi</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello<br>
<br>
Have anyone noticed that if two GPOs have for example NTLM list , only list of last processed GPO applies?<br>
<br>
Makes managing in OU level bit hard. Top level GPO settings have to be copied to sub level GPO settings, if customer wants own trust and every sub level GPO have to be updated if top level GPO is updated. Not familiar with ADMX-files but at least Internet Explorer Site-to-zone settings are appending.<br>
<br>
Thanks<br>
- Miika Sorvisto<br>
<br>
-----Alkuperäinen viesti-----<br>
Lähettäjä: Enterprise <<a href="mailto:enterprise-bounces@mozilla.org" target="_blank">enterprise-bounces@mozilla.org</a>> Puolesta <a href="mailto:enterprise-request@mozilla.org" target="_blank">enterprise-request@mozilla.org</a><br>
Lähetetty: keskiviikko 7. elokuuta 2019 15.00<br>
Vastaanottaja: <a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a><br>
Aihe: Enterprise Digest, Vol 98, Issue 5<br>
<br>
To unsubscribe via the web interface, visit<br>
<a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
or, via email, send a message with a subject or body of 'unsubscribe'<br>
to<br>
<a href="mailto:enterprise-request@mozilla.org" target="_blank">enterprise-request@mozilla.org</a><br>
<br>
Send Enterprise mailing list submissions to<br>
<a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:enterprise-owner@mozilla.org" target="_blank">enterprise-owner@mozilla.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific than "Re: Contents of Enterprise digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Inquiry: Firefox error using policy to pull from windows<br>
certificate store (Mike Kaply)<br>
2. Firefox ignores update configuration (Sirko P?hlmann)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Tue, 6 Aug 2019 16:16:39 -0500<br>
From: Mike Kaply <<a href="mailto:mkaply@mozilla.com" target="_blank">mkaply@mozilla.com</a>><br>
To: "Hoang (US), Victor T" <<a href="mailto:victor.t.hoang@boeing.com" target="_blank">victor.t.hoang@boeing.com</a>><br>
Cc: "<a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a>" <<a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a>><br>
Subject: Re: [Mozilla Enterprise] Inquiry: Firefox error using policy<br>
to pull from windows certificate store<br>
Message-ID:<br>
<<a href="mailto:CAHueOzDnewwQS%2Bn1Bs7CmuBom%2B1tF0%2BRdLy_KrSZv1HjpTuF_w@mail.gmail.com" target="_blank">CAHueOzDnewwQS+n1Bs7CmuBom+1tF0+RdLy_KrSZv1HjpTuF_w@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
On Fri, Aug 2, 2019 at 5:46 PM Hoang (US), Victor T < <a href="mailto:victor.t.hoang@boeing.com" target="_blank">victor.t.hoang@boeing.com</a>> wrote:<br>
<br>
> I forgot to show an example of what I will be trying.<br>
><br>
><br>
><br>
> {<br>
><br>
> "policies": {<br>
><br>
> "Certificates": {<br>
><br>
> "Install": ["C:\\Program Files (x86)\\Mozilla <br>
> Firefox\\cck2\\resources\\certs\\ cert1.cer", "C:\\Program Files <br>
> (x86)\\Mozilla Firefox\\cck2\\resources\\certs\\cert2.cer",<br>
> Firefox\\cck2\\resources\\certs\\cert3.cer", "C:\\Program Files <br>
> (x86)\\Mozilla Firefox\\cck2\\resources\\certs\\cert4.crt"]<br>
><br>
> }<br>
><br>
> }<br>
><br>
> }<br>
><br>
><br>
><br>
> Something like that? (I?m currently just testing so I?m installing <br>
> from a directory in which cck still exists where my certificates are <br>
> stored locally on the device. I will change it once I can get the <br>
> certs installed the first time)<br>
><br>
<br>
Yes, that should work.<br>
<br>
><br>
><br>
> Also, once I save this in the json file, I?m guessing it will create <br>
> the directories for me? E.g.:<br>
><br>
> %USERPROFILE%\AppData\Local\Mozilla\Certificates<br>
><br>
> %USERPROFILE%\AppData\Roaming\Mozilla\Certificates<br>
><br>
<br>
Nope, you'll need to create the Certificates subdir<br>
<br>
><br>
><br>
> Will it need to be a fresh install of firefox, or can I just use my <br>
> currently existing one and it will be created on start up?<br>
><br>
<br>
Doesn't need to be a fresh install. If the policy is updates, it will add the new certs/<br>
<br>
><br>
><br>
> Thanks again,<br>
><br>
> Victor<br>
><br>
> *From:* Hoang (US), Victor T<br>
> *Sent:* Friday, August 2, 2019 3:39 PM<br>
> *To:* 'Mike Kaply' <<a href="mailto:mkaply@mozilla.com" target="_blank">mkaply@mozilla.com</a>><br>
> *Cc:* <a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a><br>
> *Subject:* RE: [Mozilla Enterprise] Inquiry: Firefox error using <br>
> policy to pull from windows certificate store<br>
><br>
><br>
><br>
> I?m giving tinker with this and will get back with my findings. Silly me.<br>
> Thanks!<br>
><br>
><br>
><br>
> *From:* Mike Kaply <<a href="mailto:mkaply@mozilla.com" target="_blank">mkaply@mozilla.com</a>><br>
> *Sent:* Friday, August 2, 2019 2:30 PM<br>
> *To:* Hoang (US), Victor T <<a href="mailto:victor.t.hoang@boeing.com" target="_blank">victor.t.hoang@boeing.com</a>><br>
> *Cc:* <a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a><br>
> *Subject:* Re: [Mozilla Enterprise] Inquiry: Firefox error using <br>
> policy to pull from windows certificate store<br>
><br>
><br>
><br>
> It should just be about putting them in the right location and setting <br>
> the<br>
> Certificates->Install policy (if they aren't being imported from the <br>
> Certificates->window<br>
> store).<br>
><br>
><br>
><br>
> See:<br>
><br>
><br>
><br>
><br>
> <a href="https://github.com/mozilla/policy-templates/blob/master/README.md#cert" rel="noreferrer" target="_blank">https://github.com/mozilla/policy-templates/blob/master/README.md#cert</a><br>
> ificates--install<br>
><br>
><br>
><br>
> Are these client certificates?<br>
><br>
><br>
><br>
> Mike Kaply<br>
><br>
><br>
><br>
> On Fri, Aug 2, 2019 at 4:18 PM Hoang (US), Victor T < <br>
> <a href="mailto:victor.t.hoang@boeing.com" target="_blank">victor.t.hoang@boeing.com</a>> wrote:<br>
><br>
> Hello,<br>
><br>
><br>
><br>
> My name is Victor. I was wondering if anyone could share any <br>
> experience/expertise/solutions with switching over to policy for <br>
> managing certificates to pull from the windows store. I?m running into <br>
> some issues even after following some of the guides about how to try <br>
> and pull from my organizations windows store locations from <br>
> <a href="https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox" rel="noreferrer" target="_blank">https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox</a>.<br>
> It seems like the instructions might be a little broad/high level so I <br>
> could be missing some things. Following the guide, I have <br>
> security.enterprise_roots.enabled set to true and checked the windows <br>
> store certificate location in regedit.exe and mmc and they seem to <br>
> already exist (perhaps not in the right directory?). I asked someone <br>
> in my organization and they mentioned that all the stores can be found <br>
> on the console root (Local Computer) under trusted root certification Authorities ?<br>
> Certificates and it all seems to be there as well.<br>
><br>
><br>
><br>
> My question:<br>
><br>
> ? It seems like firefox checks<br>
> HKLM\SOFTWARE\Microsoft\SystemCertificates according to the support page.<br>
> I?m using regedit.exe to navigate to the directory, but I don?t see <br>
> any sort of ?Import? option for the certificates I want to embed. I?m <br>
> wondering how I can add my certificates into the location required by <br>
> firefox? This is what I speculate to be the culprit.<br>
><br>
><br>
><br>
> Background:<br>
><br>
> ? Switching from FF 60.8 ESR cck2 over to FF 68.0.1 ESR with<br>
> policy.json<br>
><br>
> ? Able to do majority of things such as setting up proxy,<br>
> changing home page, and Trusted Devices installed (for CSSI Library <br>
> badge authentication, etc)<br>
><br>
> ? Unable to have certificates be read from the windows store via<br>
> policy unless I manually add them to the Certificate Manager in firefox.<br>
> (Secure Connection Failed: SSL_ERROR_HANDSHAKE_FAILURE_ALERT)<br>
><br>
> Thanks all,<br>
> Victor Hoang<br>
><br>
><br>
><br>
> _______________________________________________<br>
> Enterprise mailing list<br>
> <a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a><br>
> <a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
><br>
> To unsubscribe from this list, please visit <br>
> <a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a> or send an email to <br>
> <a href="mailto:enterprise-request@mozilla.org" target="_blank">enterprise-request@mozilla.org</a> with a subject of "unsubscribe"<br>
><br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://mail.mozilla.org/pipermail/enterprise/attachments/20190806/4ac9f9e6/attachment-0001.html" rel="noreferrer" target="_blank">http://mail.mozilla.org/pipermail/enterprise/attachments/20190806/4ac9f9e6/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Wed, 7 Aug 2019 09:14:21 +0200<br>
From: Sirko P?hlmann <<a href="mailto:poehlmann@gmbu-jena.de" target="_blank">poehlmann@gmbu-jena.de</a>><br>
To: <a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a><br>
Subject: [Mozilla Enterprise] Firefox ignores update configuration<br>
Message-ID: <<a href="mailto:861a5415-ab0a-7fbc-bc01-9658142841e9@gmbu-jena.de" target="_blank">861a5415-ab0a-7fbc-bc01-9658142841e9@gmbu-jena.de</a>><br>
Content-Type: text/plain; charset=windows-1252; format=flowed<br>
<br>
Hello,<br>
<br>
We use Firefox with central software distribution, each new version is distributed to the clients via WSUS. Automatic or manual updates have been disabled for years.<br>
In the past, we used a central file to configure the presets. Since version 60.x we use the new GPOs. Actual we use .exe file, but we want to change to .msi I now found that Firefox ignores the update configuration on the clients. The clients updated to version 68.0.1 on their own.<br>
<br>
The GPO is set and applied:<br>
Computerconfiguration /MOZILLA/FIREFOX/UPDATE DISABLE : ACTIVE The clients tell me... HELP/About Firefox: "Updates deactivated by? <br>
system administrator".<br>
When I check the settings on the clients...: <br>
Settings/General/Firefox-Updates is specified: "Updates deactivated by your system administrator", the button for manual update search is grayed.<br>
<br>
Policiy Definitions are from 07/2019.<br>
<br>
Why was Firefox able to update from 60.8.1 to 68.x?<br>
<br>
regards,<br>
<br>
S. Poehlmann<br>
<br>
<br>
--<br>
Dipl.-Ing.(FH) Sirko Poehlmann<br>
<br>
Tel: 03641 3667 43 Fax: 03641 3667 77<br>
GMBU e.V. - Fachsektion Photonik und Sensorik<br>
Felsbachstra?e 7 D- 07745 Jena<br>
<a href="mailto:poehlmann@gmbu.de" target="_blank">poehlmann@gmbu.de</a> <a href="http://www.gmbu.de" rel="noreferrer" target="_blank">www.gmbu.de</a><br>
<br>
DSGVO - <a href="http://www.gmbu.de/cms/de/datenschutz" rel="noreferrer" target="_blank">http://www.gmbu.de/cms/de/datenschutz</a><br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
Enterprise mailing list<br>
<a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
<br>
To unsubscribe from this list, please visit <a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a> or send an email to <a href="mailto:enterprise-request@mozilla.org" target="_blank">enterprise-request@mozilla.org</a> with a subject of "unsubscribe"<br>
<br>
<br>
<br>
------------------------------<br>
<br>
End of Enterprise Digest, Vol 98, Issue 5<br>
*****************************************<br>
_______________________________________________<br>
Enterprise mailing list<br>
<a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
<br>
To unsubscribe from this list, please visit <a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a> or send an email to <a href="mailto:enterprise-request@mozilla.org" target="_blank">enterprise-request@mozilla.org</a> with a subject of "unsubscribe"<br>
</blockquote></div>