[1903, au] Edge (Chromium) Group Policy Settings

[kennysarmy]

Currently testing 1903 EDU with a view to replacing our 1607 LTSB deployments.

 

On Friday I installed the latest Edge (Chromium) and the ADMX templates on the domain.

 

Currently looking through all the policies that can be set..

 

Save re- inventing the wheel has anyone got a list of "must set" polices for the students?

 

Cheers

[tmoon-mint]

 

This one is an absolute must. Prevents users installing their own Extensions either from the Chrome store or Microsoft Store. I block everything and then whitelist the extensions that are required.

 

Same as you I avoided reinventing the wheel and just moved my Google Chrome settings over to Edge and all is working.

[bushby]

these are the base settings recommended by microsoft

https://blogs.windows.com/msedgedev/2019/12/18/security-baseline-draft-edge-79/

 

there is a download for what policys to set

[Chaniel]

I just duplicated our Google Chrome policy, for the "Block access to a list of URLs", change chrome:// for edge:// e.g. edge://settings or edge://extensions

 

"Managed Bookmarks" is now "Configure Favorites" (took me a while to find!)

[kennysarmy]

I've followed the recommendation for :

 

Microsoft Edge\Content settings Default Adobe Flash setting to Block the Adobe Flash plugin

 

But a few others here look like they should also be blocked!

 

 

Default geolocation setting

Set whether websites can track users' physical locations. You can allow tracking by default (1), deny it by default (2), or ask the user each time a website requests their location (3).

 

If you don't configure this policy, 'AskGeolocation' policy is used and the user can change it.

 

* 1 = Allow sites to track users' physical location

 

* 2 = Don't allow any site to track users' physical location

 

* 3 = Ask whenever a site wants to track users' physical location

 

 

Default JavaScript setting

Set whether websites can run JavaScript. You can allow it for all sites (1) or block it for all sites (2).

 

If you don't configure this policy, all sites can run JavaScript by default, and the user can change this setting.

 

* 1 = Allow all sites to run JavaScript

 

* 2 = Don't allow any site to run JavaScript

 

 

Default notification setting

Set whether websites can display desktop notifications. You can allow them by default (1), deny them by default (2), or have the user be asked each time a website wants to show a notification (3).

 

If you don't configure this policy, notifications are allowed by default, and the user can change this setting.

 

* 1 = Allow sites to show desktop notifications

 

* 2 = Don't allow any site to show desktop notifications

 

* 3 = Ask every time a site wants to show desktop notifications

 

 

Wondered how others have set these?

[caffrey]

Default notification setting in Chrome really needs a whitelist as I think it would effect incoming email notifications and calendar notifications ?

[tmoon-mint]

Anyone know if there is a way to skip the first run animation?

[mullet_man]

Anyone know if there is a way to skip the first run animation?

There is but you need the Beta GPs. So if your on stable it won't turn off the first run you need v80 at least.

 

Does anyone know how often MS will update the stable, will v80 be out any time soon?

[mavhc]

Probably every 6 weeks, same as Chrome

[mukz]

Has anyone got sync to work automatically without the user being asked to sync

[mullet_man]

Has anyone got sync to work automatically without the user being asked to sync

 

I can't see a GP that allows sync to be automatic set to "on". It's a shame as if I could enable auto login and sync I'd push Edge out now.

 

Maybe a group policy will arrive soon which will allow us to enable it.

[mukz]

I can't see a GP that allows sync to be automatic set to "on". It's a shame as if I could enable auto login and sync I'd push Edge out now.

 

Maybe a group policy will arrive soon which will allow us to enable it.

 

So we can auto login - just the damn sync doesnt work!

[mullet_man]

So we can auto login - just the damn sync doesnt work!

 

Is it showing Sync disabled?

 

Have you checked here https://docs.microsoft.com/en-us/deployedge/microsoft-edge-enterprise-sync

 

Currently I have my account syncing but not setup for the rest school as yet.

[mullet_man]

Be careful setting the "Always open PDF files externally" as you'd think it would allow files to open in Adobe but instead it gives you an warning and then you then need to click download file.

[mukz]

Yup, users can sync themselves but i want to force it for all staff and students.

 

MS Guide shows this - Sync functionality is enabled via user consent and users can turn sync on or off for each of the data types listed above. I am trying to see if i can do a reg hack but no luck yet.

[mullet_man]

Yup, users can sync themselves but i want to force it for all staff and students.

 

MS Guide shows this - Sync functionality is enabled via user consent and users can turn sync on or off for each of the data types listed above. I am trying to see if i can do a reg hack but no luck yet.

 

I'd like to force it too, have you deployed it out as yet?

[mukz]

we have it deployed to the 17 staff who are always willing to try new things - wonderful reviews so far.

[3s-gtech]

My experience with it has been ace so far. It pulls the IE Favourites across for students (from the old fashioned redirected folder) which was unexpectedly brilliant! It renders some of those daft 'Chrome only' sites as you'd expect - the user agent string can do one - I'd just like to get rid of the first-run and I may be able to hack that into the mandatory profile.

 

Edit: copying a completed first run profile into the MP may have worked. Will test further. Still comes up with a single overlay relating to sync that I may have turned off with GP.

Edited January 31, 2020 by 3s-gtech

[dfergusson]

Just heads up that their's been an update to Edge Policies that you can download, this is to go along with Edge Chromium 80 release