PolicyPak for Firefox - Consistency

[mvpatrick]

We are having a difficult time actually establishing any consistency with PolicyPak for Firefox. We have gone back to the basics. We are ONLY concerned with managing the "administrative" installation located at "c:\program files\..." and/or "c:\program files (x86)\..."

However, we continue to see varied and inconsistent results.

Also, if we configure a setting, but do NOT select "reapply" or "lockdown" should that carry through via the GPO?

Or does that require us to set a "default" value within the PP Design Studio? And then do NOT set anything within the GPO?

And what should happen when a value is set, then subsequently removed? It seems that PP never reverts it back. It appears to remain set to the initial value.

How long should we wait? We continually try "gpupdate /force" and "ppupdate" to enforce our changes.

[jeremym]

So, first, for anyone else reading this.. there are three Paks which dont act like most other paks:

- Firefox.
- Thunderbird.
- Java.

Anytime someone suggests that something is "unusual" in PP land, it's usually one of these three Paks.

Your question needs to be broken down like this:

Q1. What are the DELIVERY options that can be done in Firefox / Computer Side?
A1: Pick ONE of these three: http://screencast.com/t/gxkb1ogmMP . So you can EITHER (one must be checked):
- Deliver / Always re-apply the setting (no UI lock)
- Lockdown the setting (which implies you are also always re-applying it.)
- Force unlock (if a higher level is using Lockdown.)

Q2: What are the REVERT options that can be done in Firefox / Computer side:
A2: Answer: http://screencast.com/t/1jdzN16hifjw So you can EITHER:
- *NOT* revert / do nothing when the policy no longer applies (this is the default.)
- *DO* revert to the default when the policy no longer applies. (If you have a checkmark here, you are doing this.)

So, when you say "It seems that PP never reverts it back. It appears to remain set to the initial value" that tells me that you you DID NOT check "Revert this policy setting to the default value when it is no longer applied." When you DO check this, three things will happen:

1. The item becomes italicized.
2. You get a checkmark here: http://screencast.com/t/McCAYLB8s
3. You see it in the report: http://screencast.com/t/7zsALkTc5

Q3: When does PP apply / un-apply policy?
A4: Anytime GP applies and also when the app is re-run.

This is detailed starting on page 132 of the PP Quickstart guide build 557: "Under the hood: How PP evaluates which Paks and Settings to deliver (and revert)"

So, in order to see the settings REVERT.. you would need to:

1. Un-link or delete the GPO.
2. Run GPupdate on the target machine (required: Since there's a change in AD. There would be no other way for us to know this.)
3. Then jut re-launch the app.

You should see, say, Homepage revert from www.FromComputer.com to blank, since that is the default.

Final thoughts: PPupdate is basically not used anymore, because we automatically do an implicit PPupdate automatically when the app is re-run.

Hope this helps in your testing.

[mvpatrick]

Thanks for the quick response.

An example...

We want to launch FF with the default Homepage set to "www.google.com"

But would like to allow the end user to change it if they like

If they change it that should "stick" and if they do not then the default setting of "www.google.com" should remain

Is that possible?

[jeremym]

What you want is a Preference then and not a policy. Firefox, Java and Flash are specially handled and, as such, they are missing EXACTLY what you want to do.

I know what you want: You want to deliver www.Google.com, and the user can change it AFTER it's set.

All the other normal Paks let you do this. Do do this for other Paks (not your question, I know.. but.. go with me for a second..)

1. On the user side, do this: http://screencast.com/t/sa7AyClfzW
2. Then on the Pak itself, un-check this setting, which is ON by default: http://screencast.com/t/M1wKgNPoTz

That would deliver the checkbox ONE TIME and never again.

Buut.. okay. Firefox... its special, and as such doesn't have that. You can get CLOSE to the goal though..

1. On the setting itself, set the setting to Google.com. (This will automatically set "Always reapply this setting" .. and that's fine.)
2. On the setting itself, choose "Revert this policy setting to the default when it no longer applies"
3. On the setting itself.. don't choose lockout.
4. On the Pak (within Options) UN-check the default "Always re-apply settings when application runs".

What PP will do then is:

a. Deliver the www.Google.com.
b. Users can change the setting.
c. Users can close and re-open the app, the setting will stay whatever the user set.
d. When GPupdate succeeds, the FF settings will be re-delivered.

At this time there is no way to make a Firefox setting a "true preference".. and set it only once, and then let the user work around it at will.

I can add it as a feature request if this is a high priority for you. LMK if I've got your drift. Thanks.

[mvpatrick]

If I select "Do Not Reapply" on the PAK then none of the PP settings would get reapplied. Is that correct?

I think we are going to pull the management of FF out of PP and simply use the prefs.js file.

We had no idea that Firefox in PP was so difficult.

Are we the ONLY ones using Firefox? And, if not, are we the ONLY ones actually trying to manage / control / secure it?

[jeremym]

M:

Lots of people use the Firefox Pak. Its one of our most popular and I expressed that to you on the phone in our detailed meeting and private consult.

Help me help you..
I'm still struggling to see exactly what we DONT do that you want to do and how / what PP is / isn't doing that is making it difficult.

If your goal is specifically to:

1. Deliver a setting (as a preference), one time .. then...
2. Let the user make a change to it.

Then, yes, at this time, the FF Pak doesn't permit that.

That being said, most people use the FF Pak like this:

"We've got a set of settings (home page, security, about:config), and we want to deliver them, enforce them and optionally lock them down."

PP works exactly as designed in that scenario. And thousands of machines are being controlled via PP and the PP FF Pak that way.

Now to answer your other question..

If you're asking about unchecking "Do not re-apply settings when application runs"... then.. again, the behavior will be:

1. Defined setting will be delivered at login / gpupdate.
2. User can make changes.
3. User can close / re-open application and setting will NOT be re-applied when application runs.

But..  

Again.. I do agree this is weird and somewhat inconsistent: but in FF when GPupdate runs or the user re-logs on, the settings from PP for FF will re-apply.

Again: No one has yet had a problem with the behavior that I am aware of.

I need clarity here Patrick: Would PP satisfy your requirements if the engine were changed such that there was the ability (for the FF Pak) to deliver one time (like a preference.. ) and never re-apply again?

Is that the issue that's most important to you?

[mvpatrick]

Thanks for the quick and informative response.

I appreciate the excellent support and willingness to work with us.

What we are looking for is (probably) to general and to broad in scope.

We were hoping to configure, manage and control our rollout of Firefox to over 10000 user / systems in much the same way as we currently do with Internet Explorer.

I realize that is asking alot and I fully believe that we will get what we need from a combination of PP and Firefox itself.

I hope this helps to explain somewhat better.

[jeremym]

For future people reading this thread, here is what finally occured:

Michael discovered a scenario that PolicyPak wasn't originally designed for. And he also discovered an actual bug.

Cut to the end: We have a hotfix PolicyPak DesignStudio ready to fix both. Recompile any Pak and update the GPO and you're in business.

Here's the behavior change and also the bug that has been updated.

That desired behavior was:
-You want use COMPUTER side (switched mode)
-You want to deliver a setting "one time", so users can change it after delivery.

Current (build 557) behavior: There was no "Apply once and do not reapply" in switched mode. (There IS one in User/normal mode.)

Starting in build 559 (hotfix build) you can now do this: http://screencast.com/t/vWvXqoRgQ

The bug that was discovered:
-If you've used Firefox's Lockout routine
(http://screencast.com/t/7nxqIgZPWWS)
the UN-lock item wasn't working (build 557).

Starting in build 559 (hotfix build) and future real build fixes this issue.

To be clear: You dont need to update the CSE. Only recompile your Paks.

To request the Build 559 hotfix build of the PP DS, contact support@policypak.com and we'll send to all customers in good standing.

Thanks in advance !

[Sponsored content]