Pupils Installing Firefox/Chrome and Add-ons

[sajidmunir51]

Hi,

 

I wonder if someone can help me. Basically I work as an ICT Technician, working across 8 sites, a request has been made by IT teachers who would like to have Firefox/Chrome installed to test browsers for website they've created. now the dilema is that pupils are now going to proxy settings and changing network settings are trying to go in unfiltered, also they're adding "add-ons" to bypass proxy, I can got round to disable "Add-ons" and grey out proxy... BUT pupils are going in google.. typing download firefox.. its comes up window credentials they cant install.. so they click "No" and then Firefox asks do you want to upgradge.. at this point "Firefox" is installed in a temp folder maybe.. and now its like a clean copy of firefox and they have access to Internet unfiltered... ive used "applocker" in windows 7 and that hasnt made a difference.. please any help would be greatly appreciated.

 

kind regards,

a greatful technician

[BKGarry]

Google Chrome had GPOs that will stop that point blank for you, just like IE and are available here https://support.google.com/chrome/a/answer/187202?hl=en

 

I use the Google Chrome ones to manage our install everyday.

 

As for Firefox, there seems to an ADMX file available here but not by Mozilla themselves https://sourceforge.net/projects/firefoxadmx/

 

What I would do to stop the download is change the temporary download folders and google chrome download folder to a redirected folder under the students my docs and use server 2012 FRSM to block exe and msi files, so they cannot even download it to install it in the first place.

[Sanchez]

We use chrome and lock it down with the GPOs it has a lot of options and we haven't had any issues.

To prevent installations we have a GPO that prevents the running of anything from the users temp folder and FRSM to stop files being downloaded to their user area.

[Alis_Klar]

Also I would look into the networking and routing side of things so that there is no direct route out to the internet unfiltered. This way you are not so reliant on endpoint security and the network is more secure by design.

 

You want to make sure that unless you have a proxy configured you cannot access anything outside your LAN. Modern proxies/routers allow transparent proxying so all internet bound traffic goes through a proxy.

Edited November 22, 2016 by Alis_Klar

[ITGuyNW]

Also has anyone found a way of blocking the pop up task manager built into Chrome?

[mavhc]

Priority 1 is set up Software Restriction Policies, block all executables that aren't in c:\windows, c:\program files etc. Otherwise you'll end up with all your shared drives encrypted due to ransomware.

 

" You can now block users in your domain from ending tasks with the task manager. This is available in the Admin Console if you go to Devices > Chrome management > User settings and search for "Task manager". This policy applies to Chrome devices running version 52 and above."

 

Software\Policies\Google\Chrome\TaskManagerEndProcessEnabled

[ITGuyNW]

So it seems it can only be done as a reg file rather than GPO?

[mavhc]

GPO and reg files are kinda the same thing, download the chrome admx files.