Create Firefox deployment packages with GPOs and corporate policies

Centralize browser configuration and software In a corporate environment, it's no longer a luxury, it's a necessity. If your organization uses Firefox and you want to keep it under control, with its extensions and settings properly configured, the best approach is to leverage Active Directory, Group Policy Objects (GPOs), and Mozilla's official administrative templates. This will prevent you from relying on isolated scripts, manual installations, or a "everyone configures it however they can" approach.

Create Firefox deployment packages with GPO It allows you to install the browser itself, apply security policies, force extensions (just like you would in Edge or Chrome), and automatically distribute additional software to domain computers. Let's see, step by step, how to set up this infrastructure, how to work with Firefox's ADMX files, how to force extensions, and how to use Group Policy Objects (GPOs) to deploy other .MSI programs on your computers.

Prerequisites and overview of deployment with GPO

Before you start creating GPOs and modifying templates, you need to be clear about the minimum requirements for working seriously with group policies and Firefox in a corporate network. These are:

Active Directory EnvironmentEverything you'll see here relies on a Windows Server domain with Active Directory Domain Services (AD DS). You'll need at least one domain controller, although in real-world environments there are usually multiple domain controllers for redundancy.
Administrator permissionTo create and edit GPOs, link them to Organizational Units (OUs), and copy ADMX templates to the central store, you will need to use an account with administrative permissions in the domain or, at a minimum, specific delegations on the OUs you are going to manage.
Teams united to the domainClients (Windows 10/11, servers, etc.) where you want to deploy Firefox, its policies, or any other software must be joined to the AD DS domain. Otherwise, the GPOs will not apply.
Enterprise-format softwareFor general application deployment using Group Policy, it is recommended to work with Windows Installer packages (.msi) or with administrative installations using setup.exe /a. In the case of Firefox and its extensions, we will combine ADMX and specific parameters.

Official Firefox Administrative Templates (ADMX)

For years, managing Firefox in companies was a minor nightmare. Because there were no official administrative templates. Users had to rely on scripts, manually copy configuration files, or use third-party solutions. That changed in May 2018, when Mozilla released its own policy templates in ADMX format.

Policy compatibilityFirefox policies only work from version 60 onwards. In earlier versions, the templates will have no effect, so make sure Firefox is up to date on all your computers before you begin.

Download Mozilla templatesYou can obtain the ADMX files and their language files (ADML) from the official Mozilla repository on GitHub, in the "Releases" section of the policy-templates project. There you will find a compressed file with all the necessary templates to configure Firefox using Group Policy Objects (GPOs).

Decompression and preparationOnce you've downloaded the package, extract it to a temporary location on your administration workstation or a file server. You'll see folders for different languages and the .admx files that define the policy categories and settings.

Copy ADMX and ADML to the directive storeTo enable the Group Policy Management Editor to recognize the new templates, you must copy the ADMX and ADML files to the appropriate path, which can be local or centralized:

Local shop: C:\Windows\PolicyDefinitions on the domain controller itself.
Main store: \\dc-server\SYSVOL\domain-name\Policies\PolicyDefinitions on your primary Domain Controller or on the server your organization uses for the central store.

After copying the templates, when opening the GPO console (gpmc.msc) You will see new sections for Mozilla Firefox within the administrative templates, both in Computer Configuration and User Configuration, depending on what each version of policy-templates offers.

Creation and basic management of GPOs in Active Directory

The entire deployment of Firefox and other programs It is orchestrated through Group Policy Objects (GPOs). The general mechanics for creating, editing, and linking a GPO are the same whether you are deploying browsers, extensions, or third-party software.

Access to the Group Policy ManagerFrom a domain controller or from an administration server:

Open the server administratorGo to Tools and select “Group Policy Manager”.
If you like to get straight to the point, you can launch directly GPMC.MSC from Run or from a console.

Creating a new GPOTo centralize Firefox configuration or deploy software:

Right-click on your domain name or on the OU where you want to apply the policy.
Select “Create a GPO in this domain and link it here…”.
Enter a descriptive name, for example “Firefox – Corporate Policies” or “PuTTY Software Deployment”.

GPO EditionOnce created, right-click on it and select "Edit". The Group Policy Management Editor will open, where you'll find two main branches: Computer Configuration and User Configuration, each with its own policies, administrative templates, and software configuration options.

Security and scope controlFrom the GPO properties (Security tab in Active Directory Users and Computers or in the GPMC itself), you can adjust who has permission to "Apply Group Policy." This is where you decide which security groups will or will not see that policy. Uncheck the option for the groups you want to exclude and check it for the target groups.

Remember that the scope also depends on the OU to which the GPO is linked. You can have specific policies for a specific branch, a location, a group of servers, or only for certain types of equipment, depending on how you have designed your OU structure.

Configure Firefox via GPO with ADMX templates

Once the Mozilla templates are copied and the GPO is created, you can begin to define the policies that will govern the behavior of Firefox in the company. These policies range from configuring the homepage to blocking certain user options or controlling extensions.

Navigating Firefox templates

Within the GPO editor, under Administrative Templates, you'll see a section for Mozilla Firefox (the exact location may vary slightly depending on the version). From there, you can define settings at the user or computer level.

Typical policies that are of interest in corporate environments may include:

Blocking critical configuration changes (proxy, certificates, automatic updates, etc.).
Home page settings with the corporate intranet or service portal.
Definition of proxy servers and exclusions to control web traffic.
Disabling features that do not comply with the security policy, such as certain synchronization features or site permissions.
Extension management, indicating which add-ons are installed, which are blocked, and which are allowed.

Application of the policy to users or equipment

Depending on how you want to control Firefox, you can choose from:

Configure policies in Equipment Settingsso that they affect any user who logs into those machines.
Configure policies in User Settingsso that the settings travel with the account, regardless of the device you connect from.

It is always advisable to test policies on a subset of users or in a lab OU before rolling them out to the entire organization, avoiding surprises in production.

Automatic deployment of extensions in browsers (Firefox, Chrome and Edge)

In addition to the browser itself, in many companies It's crucial to ensure that a given extension is installed and active on all computers (for example, a security plugin, a monitoring agent, or a productivity extension). The procedure varies slightly between Edge, Chrome, and Firefox, but the logic is similar.

Typical scenario: Kabeen extension

Imagine you want to deploy the Kabeen extension for Microsoft Edge, Google Chrome, and Mozilla Firefox. The extension works in conjunction with a native agent that must also be installed on the computer to log web application usage, so you'll have to manage both components: the agent and the extension.

Step 1: Create the GPO for the extension deploymentAs before, log on to the administrative workstation or domain controller, open the Group Policy Management Console, right-click on the domain or relevant OU, and create a new GPO with a descriptive name, for example, "Kabeen Browsers Extension".
Step 2: Install the browser administration templatesOn some domain controllers, you will also need to implement the specific ADMX templates for Microsoft Edge, Google Chrome, and Mozilla Firefox to enable extension control options. These templates are also copied to the local or central PolicyDefinitions store.
Step 3: Configure the silent installation of the extension for each supported browser, using the Extensions sections within the administrative templates.

Microsoft Edge extension

To force the installation of the extension in EdgeEdit the GPO and navigate through the tree to:

User configuration > Policies > Administrative templates > Microsoft > Microsoft Edge > Extensions

Within that section, locate the policy “Control which extensions are silently installed” (or equivalent name depending on language/version). Proceed as follows:

Edit that policy and select the option Enabled.
Click on the Show to open the list of extensions that will be installed silently.
Add the Kabeen extension identifier, for example: jgdflahjneomipldehpneckiplknghbc (The exact value will depend on the supplier's current documentation.)

With this, when users log in to Edge On computers affected by the GPO, the extension will be installed automatically without asking for confirmation.

Extension in Google Chrome

In Chrome the mechanism is similarBut the policy we're interested in is the one for the forced installation list of apps and extensions. In the GPO editor, go to:

User settings > Policies > Administrative templates > Google > Google Chrome > Extensions

From there, he edits the policy. “Configure the list of apps and extensions to force installation” and:

Mark politics as Enabled.
Press on Show to add the items to the list.
Include the identifier assigned to Kabeen in Chrome, for example: hkmgmmaopoofgchofbngplopnhajbojc (always confirm this in the official documentation).

In this way, Chrome will deploy the extension in the background. for users within the scope of that GPO, without them having to go to the Chrome Web Store.

Extension for Mozilla Firefox

In Firefox, forced extension management This is also done through the administrative templates, once they are installed. In the GPO, navigate to:

User Configuration > Policies > Administrative Templates > Mozilla > Firefox > Extensions

In that branch you will find politics “Extensions to install” (or similar). To force the Kabeen extension:

Edit the policy and mark it as Enabled.
In the list of extensions to install, add the installation URL from the Mozilla add-ons portal, for example: https://addons.mozilla.org/firefox/downloads/latest/kabeen/latest.xpi.

Firefox will then automatically download and install the extension at startup, without user intervention, provided the policy is applied correctly and the browser version supports these directives.

Software deployment on domain computers using GPO

Beyond managing browsers and extensionsGroup Policy Objects (GPOs) allow you to deploy complete software on domain-aware computers. This functionality is available in all supported versions of Windows Server and is especially useful for installing common tools (VPN clients, utilities like PuTTY, agents, etc.) without having to visit each workstation individually.

The Group Directive offers two main distribution modes:

Software allocation (to users or equipment) to install automatically.
Software publishing (to users) to be installed on demand from Add or Remove Programs.

Assign a program to a user This means the software prepares at login and finishes installing when the user runs it for the first time. Assigning it to a computer means the installation occurs at system startup and it becomes available to all users of that machine.

Publish a program It makes the package appear in “Add New Programs” within Add or Remove Programs / Control Panel, and the user decides whether to install it or not.

Create the software distribution point

GPO distribution is based on a shared network resource This repository is where computers access the .msi package or installation files. It typically resides on a file server accessible to all computers in the domain.

Basic steps to set up the repository:

Log in to the file server or the Domain Controller itself with administrator privileges.
Create a folder that will act as a software repository, for example “SoftRepo”.
Right click on the folder, enter Properties and go to the tab Share.
Press on Advanced sharing, check the box “Share this folder” and then click on Permissions.

Set sharing permissions by removing generic access to "Everyone" and adding the appropriate groups or users (for example, All computers in the domain and All users in the domain, according to your security policy).

In the Security tab of the folderGo to Advanced Options, add the necessary groups, and grant them read permissions (or the appropriate permissions). This ensures that the computers will be able to download the installer without NTFS permission issues.

Check that the access works Enter the full UNC path into your file explorer, something like \\SRV-OLIN02-001\SoftRepo. If it opens correctly, your distribution point is ready.

Publish or assign an MSI package using Group Policy

The next step is to create the software installation GPO and link it wherever you want. You can do this from either Active Directory Users and Computers or the GPMC, but the process is the same.

Creating the GPO from Active Directory Users and Computers:

Open “Active Directory Users and Computers” from Administrative Tools.
In the tree, right-click on the domain and choose Properties.
In the Group policy, click on New to create a GPO and give it a descriptive name.
On the Security tab, configure which groups have permission to "Apply group policy" by checking or unchecking as needed.

Assign the software package This is done for teams or users from the GPO editor:

Modify the GPO by clicking on Modify from the Group Policy tab or from the GPMC.
Low Equipment setup, expand software configuration and enters Software installation if you want the program to be installed at startup of the computers.
Right-click on Software Installation, choose New > Package.
In the Open dialog box, specify the full UNC path to the .msi file on the share: for example, \\server\SoftRepo\program.msi.
Select the package and, when prompted, choose the method Assigned.

The package will appear in the right panel of the editor. as a program managed by GPO. After closing the editor and applying the policy, the affected machines will install the software on their next restart.

If instead of assigning you want to publish a package for usersGo to User Settings > Software Settings > Software Installation, create a new package with the same UNC path, and select the method PublishThe program will appear in “Add New Programs” in the Control Panel, from where users can install it manually.

Maintenance: redeploying and removing packages

The life of a software package in an organization It doesn't end with the initial installation. Sometimes you'll need to update, redeploy, or remove it entirely. Group Policy offers options to manage all of this in a controlled manner.

Redeploy a package This may be necessary when you release a new version or have fixed a bug in the MSI. To do this:

Open Active Directory Users and Computers, go to Domain Properties and the tab Group policy.
Select the GPO you used to deploy the package and click on Modify.
In the editor, expand the branch of software configuration which contains the Software Installation entry.
Click on the Software Installation container, locate the program in the right panel, right-click on it, and select All tasks and then Redeploy the application.
Confirm the message indicating that the application will be reinstalled in all locations where it was previously installed.

From then on, on subsequent restarts or loginsThe teams will receive the package again and it will be updated as defined in the MSI.

Remove a package This is equally important when the software becomes obsolete or is replaced by another:

From the same Software Installation container, right-click on the program and select All tasks > Remove.
The system will offer you two options: Immediately uninstall the software from users and computers. o Allow users to continue using the software but prevent new installations.
Choose the one that best fits your transition strategy and confirm.

Please note that sometimes the published packages These programs may continue to appear on client workstations even after being removed via Group Policy, especially if the user installed them but never ran them. The installation will complete when the program is run for the first time, and Group Policy will then remove them according to the new configuration.

Master these maintenance options It allows you to maintain a much cleaner and more homogeneous software fleet, avoiding old versions forgotten on some machines.

By combining official Firefox administrative templates, GPOs for browser extensions, and software installation via MSI packagesYou gain fine-grained control over which browser is used, what policies govern it, and what additional tools are present on workstations. With minimal planning (software repository, well-thought-out OU structure, and prior lab testing), deploying Firefox and its corporate policies with GPOs goes from a tedious task to a predictable, repeatable, and much more convenient process for system administrators.