[wpkg-users] Firefox 3.6

[Rainer Meier]

Hi Donny,

On 22.07.2010 18:50, Donny Brooks wrote:
> First off I need firefox to NOT check for updates since our users cannot
> install/upgrade software. Our current installs of seamonkey and acrobat drive me
> batty when people start sending helpdesk requests because those programs are
> trying to update before I can push out the updates via wpkg.

Current Firefox versions will only display a notice message to the user that
upgrade cannot be performed (if the user does not have admin privileges). It
just does this once.

Well, the second option is to use Firefox policies to disable specific features
- or lock some.

To do so just do the following:
1. create/copy "%ProgramFiles%\Mozilla Firefox\defaults\pref\policies.js"
I am using policies.js with the following content:

pref("general.config.obscure_value", 0);
pref("general.config.filename", "mozilla.cfg");


(yes, just these two lines)

The first line configures Firefox to use non-obscured mozilla.cfg entries. If
you don't use this line then you need to "obfuscate" mozilla.cfg. There is a
tool called "foxycrypt.exe" which can do it for you. However it used to crash on
my Vista/7 x64 machines and I see no benefit of obfuscating (in reversible way)
mozilla.cfg. So I want to use plain mozilla.cfg.


2. Place your settings in "%ProgramFiles%\Mozilla Firefox\mozilla.cfg"

An example:
// Disable compatibility check
lockPref("extensions.checkCompatibility", false);
// Disable the "What's new" page after upgrades
lockPref("browser.startup.homepage_override.mstone", "ignore");
// Hard-code proxy and disallow users to change it
lockPref("browser.shell.checkDefaultBrowser", false);
lockPref("network.proxy.backup.ftp", "192.168.0.2");
lockPref("network.proxy.backup.ftp_port", 8082);
lockPref("network.proxy.backup.gopher", "192.168.0.2");
lockPref("network.proxy.backup.gopher_port", 8082);
lockPref("network.proxy.backup.socks", "192.168.0.2");
lockPref("network.proxy.backup.socks_port", 8082);
lockPref("network.proxy.backup.ssl", "192.168.0.2");
lockPref("network.proxy.backup.ssl_port", 8082);
lockPref("network.proxy.ftp", "192.168.0.2");
lockPref("network.proxy.ftp_port", 8082);
lockPref("network.proxy.gopher", "192.168.0.2");
lockPref("network.proxy.gopher_port", 8082);
lockPref("network.proxy.http", "192.168.0.2");
lockPref("network.proxy.http_port", 8082);
lockPref("network.proxy.no_proxies_on", "localhost, 127.0.0.1");
lockPref("network.proxy.share_proxy_settings", true);
lockPref("network.proxy.socks", "192.168.0.2");
lockPref("network.proxy.socks_port", 8082);
lockPref("network.proxy.ssl", "192.168.0.2");
lockPref("network.proxy.ssl_port", 8082);
lockPref("network.proxy.type", 1);


Well, basically you can put any setting there which you can find in "about:config".

So I think what you're looking for is a mozilla.cfg entry as follows:
// Disable automatic update checks
lockPref("app.update.autoUpdateEnabled", false)



> Secondly, I need to be able to set the homepage on the firefox browser.

// Define start page
lockPref("browser.startup.homepage", "http://mypage.tld")
lockPref("browser.startup.page", 1)


Note: No warranties... I did not try the autoUpdateEnabled or homepage
preference locks yet.

Note2: Instead of lockPref() you might use just pref() to define the default
value and allow users to override them.


> Third, I need to know if anyone else has disabled Internet Explorer using WPKG.
> I know how to remove access to it in Vista using the program access and
> defaults, but not sure how to do it with wpkg or if it is even possible. I have
> searched for a registry entry to do this but to no avail.

Never did it. And I doubt it's possible to disable it completely. It's also
possible to enter URLs directly in explorer and it turns into IE then. Lots of
applications are using the IE engine to display HTML pages. So disabling the
complete subsystem might not be possible.
But if you're talking about the IE front-end it might be sufficient to remove
read rights for normal users on iexplore.exe:

cacls "%ProgramFiles%\Internet Explorer\iexplore.exe" /R Users /C /E

Use with caution and try on a lab system first. This might even render your
system useless... I DID NOT TRY THIS!

br,
Rainer