Homepage via GPO not working after updating to 63

[maxmino72]

Hi,
I've used GPO to configure homepage on corporate clients.
After updating to Firefox 63 this setting no longer works.
I've checked the new policy template (1.3) to verify if registry key was changed but it is the same.
Anyone is experiencing the same problem?

[mkaply]

Per the documentation, we've moved this to be a machine policy (I left it as a user policy because it works that way in older versions).

I'll be removing the user entries.

[maxmino72]

I've tested the policy per computer configuration and it works fine but I don't understand why you want move policies from user to computer configuration.
In a large company it's better and more simplex to apply policy by user configuration, for example on terminal server environment the computer configuration doesn't fit my requirement because settings applied from the policy per computer will be the same for all users, even if they belong to different department.

[mkaply]

I've tested the policy per computer configuration and it works fine but I don't understand why you want move policies from user to computer configuration.

It was either that or make them ESR only. See:

https://bugzilla.mozilla.org/show_bug.cgi?id=1461730

Because user policies are in the user registry, they can be arbitrarily changed by any application without permission facilitating hijacking.

We are investigating other solutions (including requiring that you are connected to an ActiveDirectory server)

Note that previous to this change, these policies didn't work at all except on ESR (although they worked on 62 due to a bug).

[maxmino72]

User policies, as computer policies, can be modified by user or any dangerous application only if he has administrative privileges (this registry key/value is readonly for the user).
For security context there isn't any difference storing policies in user or computer settings, in the registry or in a settings file.

[mkaply]

My understanding was that any application can add/modify registry entries in HKEY_CURRENT_USER without any special permission, but you need admin permission to modify HKEY_LOCAL_MACHINE.

We're primary concerned about third party applications modifying policies, not users.

[maxmino72]

By design not all registry entries in HKEY_CURRENT_USER are writeble from user.
The specific key HKEY_CURRENT_USER\Software\Policies is writable only from administrators otherwise any users or processes running in the same security context could modify settings and it would be too easy to bypass security and organization policies.
The same for HKEY_LOCAL_MACHINE\Software\Policies.
You can see yourself in "Permissions" section of your registry key.

[mkaply]

Interesting. I don't understand then why Chrome only allows certain policies when connected to an active directory server.

Based on this information, I'll change this back for Firefox 64.

[mkaply]

This had been fixed in 64./