Student lock-down GPO for "new Edge"

[enjay]

Save me reinventing the wheel, does anyone have a GPO to lock "new Edge" down for students which they could share with me?

[MYK-IT]

Save me reinventing the wheel, does anyone have a GPO to lock "new Edge" down for students which they could share with me?

 

Subscribed as I'm working on (re)configuring similar too. Hopefully someone will post!

 

Thanks,

[tmoon-mint]

Do you have a GPO for Chrome? I literally just replicated all my settings from that but I can share my GPO in the morning.

[jthompson]

That would be my suggestion, too. If you have existing GPOs for Chrome, just pick your way through and replicate as much as you need into the Edge templates. The templates are super similar - even things like extension whitelising are laid out in the same way.

 

One thing I can't remember is whether you first need to install the admx templates for Edge like you would need to do with Chrome. I suspect you do, so once you've done that, just read through all the available settings and consider what you'll need to be configuring for either computers or users.

 

Some settings that you probably want to ensure that have you set in Computer configuration/Policies/Administrative Templates/Microsoft Edge for all computers are: "Allow surf game", "Hide the First-run experience and splash screen" and "Send required and optional diagnostic data about browser usage". The surf game being the equivalent of Chrome's dinosaur game.

[tmoon-mint]

So these are the settings I would make sure you absolutely have enabled:

 

* Allow surf game - Disabled

* Default Notification setting - Do not allow any site to show desktop notifications

* Control which extensions cannot be installed - I have this set to * so it blocks all browser extensions. I then whitelist the same list of extensions I use in Chrome

* Allow users to access the games menu - Disabled

* Allow download restrictions - Block dangerous downloads

* Enforce Bing safe search - Enabled

* Enforce google safe search - enabled

* We dont allow Youtube for students but if you did you can enforce restricted mode

* If you're migrating from another Browser its probably worth allowing importing of browser settings and setting it to import them at first run

* Configure favourites - I just used the same ones from Chrome

 

I am always looking to improve my policies though so interested to see what others have.

[MYK-IT]

Hi @jthompson

 

Must admit, I was going to use our Chrome ADMX as a stating base, but was using this as an opportunity to start fresh (and use Microsoft Edge as default etc.)

 

I am attempting to do all via Microsoft Endpoint Manager and already have a Microsoft Edge Security Baseline in place, with the settings you've mentioned (and more) within an additional Device Configuration Policy. Although I note that the "Send required and optional diagnostic data about browser usage" policy is not supported on Windows 10 devices (you must use Windows diagnostic data group policy - https://go.microsoft.com/fwlink/?linkid=2099569).

 

I am curious if other settings are being applied. For example, dis/abling password manager, favourites etc. Plus, I am sure that I have read (although cannot find article at present) that if on Windows 10 Education you shouldn't get adverts / news articles etc on the default home tab/page - which I'm currently experiencing through testing (e.g. AD SSO enabled etc)

 

Many Thanks,

 

Edit:

Forgot to mention that I also disable the QUIC Protocol - as allowing that could potentially circumnavigate internet filtering / SSL-DPI inspection etc.

Edited March 18, 2022 by MYK-IT

[jthompson]

This thread has prompted me to update our admx templates for both Chrome and Edge. Quite a few new options appearing for Edge since I last did it. In particular New Tab Page 'content' (i.e. news) and MS rewards 'experience' cruft.