Deploying Firefox

[Arthur]

I cannot prevent the FireFox 'First Time Run' at the moment.

Do you mean the Welcome and/or Upgrade tabs users get when Firefox is run for the first time/updated or the Import Wizard box? To fix the former, you can add this to your mozilla.cfg.

 

lockPref("browser.startup.homepage_override.mstone", "ignore"); // Do not redirect user to the homepage override URL
lockPref("startup.homepage_override_url", ""); // The URL to use as a homepage when the browser starts after an upgrade
lockPref("startup.homepage_welcome_url", ""); // The URL to display upon loading Firefox with a new profile for the first time

This is quite useful too.

lockPref("browser.rights.3.shown", true); // Disables 'Know your rights' message on first launch

When I've got a bit of time I'll post my mozilla.cfg. It's a bit more comprehensive than Michael's.

[paulhowes]

OK

I have worked in a number of schools in Birmingham for the past few years. For about a year now I have noticed a major deterioration in the efficiency of using IE for browsing. Is very weird and very inconsistent. Particular problems occur when trying to access MyMail (BGFL+) and local ePortal services. Browser seems to hang and crash very regularly!!

 

I am glad (if that is the right choice of words?) to have found i am not the only one who is having these problems. I work in 5 different schools, 2 of which seem to have little or no problems compared to the other 3. It has to be down to the way schools are routed through the BGFL is all i can think?

 

IE 7 & 8 are both affected. I have tried FF and early signs seem encouraging

 

I am now in the process of looking to deploy FF as an alternative browser to schools but in the past was put off a little due to many of the points listed in this excellent thread. I just want to extend my thanks to all who have contributed (especially Michael & Arthur) and will report back here in a couple of weeks to provide my feedback\updates.

 

Many Thanks

Paul

[paulhowes]

and just wanted to add, these problems seemed to occur around the same time Policy Central was installed.........or is that just me thinking this?!?!?

[Michael]

Hi Paul, your theory is correct that IE and Policy Central do have major problems working together. It dates back to June 2009 when Microsoft released a patch to IE and this conflicts with Policy Central. Typical symptoms are IE crashing, slow browsing and problems opening PDFs.

 

Firefox for the most part solves these problems and since deploying it to the schools I support, problems have considerably reduced. E-portal works much better and browsing in general is much faster and more reliable.

 

At the time of writing the promised Policy Central 3.0.0.9 patch still hasn't been released, which is meant to fix these problems. At one site (communicating with Link2ICT) they had to disable Policy Central completely as it reduced browsing close to dial-up speed at times.

[rocknrollstar]

@Michael

http://www.edugeek.net/forums/windows/42484-deploying-firefox-5.html#post407931

 

Hi Michael, I'm very interested in deploying FF at our school, but I'm having issues getting it working. I followed the instructions in the post above, created Mozilla.txt with lockedprefs, edited Hampshire proxy values, used byteshifter with value 13, downloaded proxy free FF "Mozilla Firefox (3.5.5) Logistix ProxyFree.rar", replaced the cfg file. The MSI installs without issue.

 

However when I start FF, I get the Configuration Error "Failed to read the configuration file. Please contact your system administrator".

 

Any thoughts? I had FF installed before, but removed this and Program Files\Mozilla directory and App Data\Mozilla directory. Still no joy.

 

Thanks in advance

[Michael]

However when I start FF, I get the Configuration Error "Failed to read the configuration file. Please contact your system administrator".

 

There must be a problem with the new config file you've created. To experiment copy my code exactly and save as mozilla.txt and output as mozilla.cfg, then replace the existing one. If this works then I would double check what changes you've made.

[rocknrollstar]

You're right- turns out I missed the '//' at the start of the cfg file. Thanks. I do have 2 questions though.

 

1) I know I can deploy FF via GPO using the msi, but can I also just copy the files across to the clients? Does it need to be installed properly?

 

2) Is it possible to install FF plugins, and if so, how?

 

Thanks again.

[Michael]

I would recommend you install it properly via GPO or run the MSI manually. It should be very quick even on average spec machines.

 

If I've understood correctly, you can install extensions silently using the following example:

 

firefox.exe -install-global-extension extension.xpi

[rocknrollstar]

Thanks Michael.

 

Another question for you! WHen you right click an image in FF, you can set it as the desktop image. Is it possible to disable this? We use bginfo to set the wallpaper on login, but would rather not rely on this.

 

Also, if I make a change in Mozilla.cfg (i.e. change the default home page), what's the best way to update all the clients who already have the FF msi installed? Do I make a new GPO, and remove the original one?

Cheers

[Michael]

Internet Explorer has the same function and as far as I am aware it cannot be removed, unless Arthur knows of a way? However, if the profile the user is using is mandatory or read only, the wallpaper would be lost when they logoff.

 

You could in theory just overwrite the mozilla.cfg file on machines remotely, however if Firefox is in use it can create problems. I would recommend you deploy Firefox again to the few machines you want to update the homepage.

 

By making changes in the Firefox distribution folder, you can then re-deploy the package again in AD.

Edited November 21, 2009 by Michael

[Arthur]

Another question for you! When you right click an image in FF, you can set it as the desktop image. Is it possible to disable this?

It sure is. You need to add this to your userChrome.css file.

 

#context-setWallpaper, #context-setDesktopBackground { display: none !important; }

 

I normally hide a lot more though than that though on our context menus. The code below hides the set desktop background options, the bookmarking options, all the different 'Send' links - because our students use webmail and not Outlook - and the ability to add words to the dictionary and additional dictionaries too.

 

#context-setWallpaper, 
#context-setDesktopBackground, 
#context-blockimage, 
#context-bookmarkframe, 
#context-bookmarklink, 
#context-bookmarkpage, 
#context-keywordfield, 
#context-sendlink, 
#context-sendimage, 
#context-sendvideo, 
#context-sendaudio, 
#context-sendpage, 
#spell-add-to-dictionary, 
#spell-add-dictionaries, 
#spell-add-dictionaries-main, 
#spell-language-separator { display: none !important; }

[Arthur]

Also, if I make a change in Mozilla.cfg (i.e. change the default home page), what's the best way to update all the clients who already have the FF msi installed? Do I make a new GPO, and remove the original one?

Firefox actually has the ability to load its configuration from another location on your network such as an internal web server. This allows you to centrally manage the configuration for all of your Firefox installations. If you Google autoadmin.global_config_url you will be able to find out how to do this.

 

Rather than redeploying the Firefox package to update the mozilla.cfg you could use a startup/shutdown script or even Group Policy Preferences if you have it.

Edited November 21, 2009 by Arthur

[Arthur]

You could in theory just overwrite the mozilla.cfg file on machines remotely, however if Firefox is in use it can create problems. I would recommend you deploy Firefox again to the few machines you want to update the homepage.

From the testing I have done, overwriting the mozilla.cfg is fine even when users have Firefox open. However, Firefox will only pick up the changes you made to the .cfg after it has been restarted.

[gtaylor]

We use this at our school... most of what you guys are trying to do is achievable deployting Firefox-CE and using Group Policy to control and lock these settings.

 

FrontMotion Firefox Community Edition

[Alomax]

@gtaylor - I've tried the FF CE and ADM templates, but it doesn't cover the 2 things I need most : disabling file:// and filtering downloads

 

@Aurthur and Michael - thank you both, you guys have been a huge help in locking down FF in my store. I'm using Michael's MSI with some tweaked CFG options, and Aurthur's menu-disabling CSS. However the 2 are not entirely compatible For instance, the CSS tries to disable #bookmarksMenu, however in Michael's custom version it is not disabled, it appears to use a different ID tag as it is named "Favorites", and I cannot load the DOM inspector to find out what tag it is since addons are disabled (lol)

 

Also, I cannot seem to figure out a way to filter downloads using any method. I want to replicate the behavior of the Public Fox plugin, in that it allows you to block the downloading of some file extensions, but not all. I want to block EXE, BAT, ZIP, RAR and others, but allow things like .DOC, .PDF, and .JPG Any suggestions?

 

Thanks for all your guy's work!

[Michael]

For instance, the CSS tries to disable #bookmarksMenu, however in Michael's custom version it is not disabled, it appears to use a different ID tag as it is named "Favorites", and I cannot load the DOM inspector to find out what tag it is since addons are disabled (lol)

 

For clarification (by default) Internet Explorer uses Favourites and Firefox uses Bookmarks. The Bookmarks menu is being disabled by userChrome.css and as its replacement a Firefox extension is installed so it displays Favourites.

 

The whole purpose of this idea is so users can dynamically switch between Internet Explorer and Firefox and still keep their Favourites. Some websites/applications unfortunately still require Internet Explorer, but the majority will run using Firefox. As a result it means even less experienced users have a small learning curve if they switch from one browser to the other.

 

There might be an extension that allows you to block specific file extensions. Have a look here

[Arthur]

Michael is correct. We both use the Plain Old Favourites add-on for Firefox as this allows users to keep the favourites they already have in Internet Explorer while avoiding confusion and duplication of sites in both browsers. Hence why the native Firefox bookmarking system is disabled. While our students would be fine with this, I don't think staff would be able to cope with two sets of bookmarks.

 

Blocking file-types is normally done at the Internet gateway/proxy level, but I'm sure there is a way to do this with Firefox.

[Alomax]

That's pretty slick actually.

 

There is an addon that filters downloads : https://addons.mozilla.org/en-US/firefox/addon/3911

 

It does a lot of the same things that Michael's MSI build does, but I haven't figured out how to integrate it into my custom build yet. The -install-global-extension command will install the addon, but not configure it (default filters no downloads). I suspect I can set the extension options in the mozilla.cfg file the same way as the other settings, right?

 

If I can filter the allowed extensions, this will be perfect!

[cookie_monster]

I haven't really been following this thread, i'm just wondering if this has been posted.

 

Firefox MSI

[Michael]

I am aware of Frontmotion's existence, however the Logistix Mozilla Firefox 3.5.7 Pack does things Frontmotion's does not. Typical examples of this are -

 

- The Tools > Options menu is all greyed out and unchangeable

- Bookmarks is replaced with Favorites. Users can switch between IE and FF and keep the same list of Favorites

- Add-ons cannot be installed, improving security and consistency

- Upgrading FF is disabled. This allows a Network Manager to consistently keep the same version across their domain

- Proxy Settings and Exceptions are configured by default

- The Homepage is configured by default

 

I hope this clarifies the differences

[cookie_monster]

I am aware of Frontmotion's existence, however the Logistix Mozilla Firefox 3.5.7 Pack does things Frontmotion's does not. Typical examples of this are -

 

- The Tools > Options menu is all greyed out and unchangeable

- Bookmarks is replaced with Favorites. Users can switch between IE and FF and keep the same list of Favorites

- Add-ons cannot be installed, improving security and consistency

- Upgrading FF is disabled. This allows a Network Manager to consistently keep the same version across their domain

- Proxy Settings and Exceptions are configured by default

- The Homepage is configured by default

 

I hope this clarifies the differences

 

 

 

So it's similar but school proof

[Michael]

So it's similar but school proof

 

Exactly, you got it! The original reason for the creation however was because of Policy Central, however thankfully the latest v3.0.0.9 appears to speed things up. Still as a precaution I'm still going to keep both browsers operating side by side and I recommend others do too

[Arthur]

I haven't really been following this thread, i'm just wondering if this has been posted.

The FrontMotion .msi has been mentioned before, but the main problem I see with it is that his releases often lag anywhere between several days to a few weeks behind the official Mozilla releases; sometimes even missing out point releases completely! The table I created below illustrates this quite well. IMO, a bit worrying when there are so many zero day exploits around these days. Another disadvantage is that the FrontMotion GPOs are incapable of setting defaults for users without locking them completely or modifying other Firefox settings which are controlled via JS/CSS files (as far as I can tell).

 

[b]Release[/b]    [b]  Mozilla[/b]          [b]     Front Motion[/b]    [b]   Difference[/b]
3.5       30/06/2009   07/07/2009       8 days
3.5.1     16/07/2009   22/07/2009       7 days
3.5.2     03/08/2009   05/08/2009       2 days
3.5.3     09/09/2009   18/09/2009      10 days
3.5.4     27/10/2009       -           17 days
3.5.5     05/11/2009   12/11/2009       8 days
3.5.6     15/12/2009   31/12/2009      17 days
3.5.7     05/01/2010   11/01/2010       7 days

 

Also, as mentioned above, Michael's (and my own) customized versions of Firefox are more school-proof.

Edited January 18, 2010 by Arthur

[cookie_monster]

So are you setting it up so IE and FF can be run at the same time by users? How are you making it so they share favorites and history etc? (or has this been covered deep in the thread)

[Michael]

Yes, both IE and FF can be run at the same time. The important little trick is FF is set to not check whether it's the default browser and IE is also set to not check whether it's default using Group Policy. They'll then work together without nagging the user.

 

IE technically remains the system default however which is still recommended. IE is used for many system functions as it's well integrated into Windows XP for example. To ensure users use a specific browser for a particular website, you can create a custom shortcut. By creating a shortcut from Firefox.exe, the target path would read as follows:

 

"C:\Program Files\Mozilla Firefox\firefox.exe" http://www.logistixonline.com/

 

The Bookmarks menu has been removed from FF and an add-on to emulate IE's Favorites is included. This means both browsers dynamically read Favorites, so if I add a new Favorite in IE, it's visible in FF and visa versa.

 

IE and FF History is not shared or transferred. Generally speaking a user will use one browser or the other and rarely both at the same time. This probably is possible to achieve, but I haven't seen the demand for it.