Firefox¶
Same goals as Chrome, different menus, plus one trap that's specific to Firefox.
Settings¶
Open about:preferences.
| Page | Setting | Value |
|---|---|---|
| General → Firefox Updates | Automatically install updates | |
| Privacy & Security → Enhanced Tracking Protection | Strict | |
| Privacy & Security → Permissions | Block pop-up windows | Ticked |
| Privacy & Security → Permissions | Warn you when websites try to install add-ons | Ticked |
| Privacy & Security → Security | Block dangerous and deceptive content | Ticked |
| Privacy & Security → Security | Block dangerous downloads | Ticked |
| Privacy & Security → Security | Warn you about unwanted and uncommon software | Ticked |
| Privacy & Security → HTTPS-Only Mode | Enable HTTPS-Only Mode in all windows | |
| Privacy & Security → Logins and Passwords | Ask to save passwords | Unticked, if the organization uses a password manager |
Add-ons: about:addons → Extensions. Remove anything without a business purpose.
Where the settings live¶
Firefox stores user settings in prefs.js inside the profile folder: %APPDATA%\Mozilla\Firefox\Profiles\<random>.default-release\. about:config shows the same values by name. Useful for confirming a change took:
| Preference | Should be |
|---|---|
app.update.auto |
true |
dom.disable_open_during_load |
true (this is the pop-up blocker) |
xpinstall.whitelist.required |
true (warn on add-on install) |
browser.safebrowsing.malware.enabled |
true |
browser.safebrowsing.phishing.enabled |
true |
browser.safebrowsing.downloads.enabled |
true |
dom.security.https_only_mode |
true |
The mozilla.cfg trap¶
Firefox can be locked down system-wide with a file called mozilla.cfg in the install folder (C:\Program Files\Mozilla Firefox\), pointed to by defaults\pref\local-settings.js. IT departments use it to enforce settings. An image can use it to silently disable updates, and the preferences window will still look right.
Check for both files:
Get-ChildItem "C:\Program Files\Mozilla Firefox\mozilla.cfg", "C:\Program Files\Mozilla Firefox\defaults\pref\local-settings.js", "C:\Program Files\Mozilla Firefox\distribution\policies.json" -ErrorAction SilentlyContinue
If mozilla.cfg exists, open it. Lines like these are the problem:
lockPref("app.update.enabled", false);
lockPref("app.update.auto", false);
defaultPref("browser.safebrowsing.malware.enabled", false);
Delete the offending lines. If the file exists only to disable things, delete mozilla.cfg and local-settings.js both. distribution\policies.json does the same job in a different format; read it the same way.
After removing the lockdown, open About Firefox and it will find the update it was blocked from seeing.
Verify¶
about:policies shows active enterprise policies (should be none, or only ones you set). about:config search for app.update.auto should show true and not locked.
Example¶
About Firefox says version 102 is "up to date." That's years old. mozilla.cfg exists and contains lockPref("app.update.enabled", false);. Delete the file and local-settings.js, restart Firefox, open About, and the update downloads.