When you're managing a corporate network with dozens or hundreds of computers, installing programs one by one is a real nightmare. That's why mastering automatic software distribution is essential for any system administrator who wants to stay sane and save valuable time on repetitive tasks.
In the specific case of Mozilla Firefox , the process has evolved considerably. Previously, it was a headache because standard tools were lacking and complex scripts had to be used, but nowadays, having an Active Directory environment greatly facilitates the browser arriving at each workstation already configured and ready to use.
Preparing the ground: ADMX templates and requirements
In order for Windows to understand the rules we want to enforce in Firefox, we need to install the management templates (ADMX) . These templates are essentially the "instruction manual" that allows the Group Policy Object (GPO) console to display all the browser's configuration options.
First, download the updated definitions from Mozilla's official GitHub repository. Once you have the file, extract it and move the files. ADMX and ADML to your domain controller's policy store. If you prefer the local store, go to C:\Windows\PolicyDefinitionsBut if you want everything centralized, the ideal solution is to take them along the route of SYSVOL of the domain.
It's important to mention that these policies are not compatible with very old versions, specifically they don't work with versions lower than 60 , so make sure your computer infrastructure is up to date before you start thinking about this.
Creating the MSI deployment package
The standard installer isn't enough; for the GPO to work, we need the Mozilla Firefox MSI package . This format is the standard for automated installations on Windows Server, as it allows for silent execution without the user having to click "Next" ten times.
The next critical step is to create a distribution point . You can't simply point to your C: drive; you must create a shared folder on the network (for example, called "SOFTWARE") and place the MSI installer there. The most important thing here is to adjust the security permissions so that all computers and domain users have read permissions, allowing the system to access the file during startup.
GPO configuration for automatic installation
Now that we have the file on the network, let's go to the Group Policy Management Console (GPMC.MSC) . Here you need to create a new GPO with a clear name, such as "Firefox Enterprise Installation," and link it to the Organizational Unit (OU) where the computers that should receive the browser are located.
Within the policy editor, navigate to Computer configuration > Policies > Software configuration > Software installationBy right-clicking on "New", you select "Package" and look for the UNC path of your shared folder (style \\servidor\software\firefox.msi). In the implementation method, you must choose Assigned so that the program is installed automatically when the computer is turned on.
If you ever need to update the browser or change the version, you can use the Redeploy application option from the same panel, which will force a reinstallation on all affected machines.
Management of extensions and corporate policies
Once the browser is installed, you may want to force the use of certain tools. For example, to deploy extensions like Kabeen or other corporate extensions, you need to go to Administrative Templates > Mozilla > Firefox > Extensions.
When editing the "Extensions to Install" directive, you must enable it and paste the URL of the .xpi file (the Firefox add-on format). This way, the browser will automatically download and install the add-on without user intervention, ensuring that everyone has the same security or tracking tools installed.
If you need to remove a tool, the process is similar: access the software settings and select Remove . You can choose between uninstalling the software immediately or allowing users to continue using it but preventing it from being installed on new computers.
To verify that everything is working correctly, you can run the command `gpupdate /force` in the command prompt of a client machine with administrator privileges. If the system prompts you to restart to apply the startup policy, confirm, and after the restart, the browser should magically appear in the Start menu.
The correct implementation of Firefox through GPO involves everything from preparing the ADMX files and creating a shared repository with UNC permissions, to assigning the MSI package and configuring forced extensions, allowing total control over corporate browsing without manual effort.