Tip: This document is only needed for customers using PolicyPak Application Settings Manager and Firefox ESR. There is no required special workaround for PolicyPak Browser Router except using the latest PolicyPak CSE and Firefox ESR 115 and later.
Firefox 115 and later has made a breaking change internally which makes our longstanding plug-in implementation fail to operate. This change is expected to be permanent, and as such required a few items to workaround and fix it:
Tip: If you are using the PolicyPak DesignStudio yourself to make any changes to the Firefox 23 AppSet, you will need to re-compile with the latest PolicyPak DesignStudio and then perform the steps listed below.
This document is to help guide you through the required transition.
We will refer to the original Firefox AppSet as FF23 AppSet and the updated one as Firefox AppSet as FF115.
You can acquire the updated FireFox AppSet 115 in the PolicyPak Portal within the AppSets downloads.
Tip: It is recommended, though not strictly required that you also update your management station to the latest PolicyPak MMC snap-in. In doing so the screenshots shown here will match the steps you will be performing.
|
Firefox ESR version |
CSE Version |
AppSet Version Compiled with |
Expected Behavior |
|
102.9 and below |
23.8 and below |
23.8 and below (aka FF23 AppSet) |
Works |
|
102.9 and below |
23.10 and later |
23.10 and later (aka FF 115 AppSet) |
Works |
|
102.9 and below |
23.8 and below |
23.10 and later (aka FF 115 AppSet) |
Not Work |
|
115 and later |
23.10 and later |
23.8 and below (aka FF23 AppSet) |
Not Work |
|
115 and later |
23.8 and below |
23.10 and later (aka FF 115 AppSet) |
Not Work |
|
115 and later |
23.10 and later |
23.10 and later (aka FF23 AppSet) |
Works |
The upshot is:
Additionally, you will want to ensure that your existing FF23 AppSet policies do not get pushed down to the machines with the new 23.10 and later CSE. During this guide you will use Item Level Targeting to ensure that the older FF23 AppSet cannot work with, and shouldn’t be applied to newer CSEs; therefore we need to ensure that the newer FF115 AppSet only applies to the newer CSEs.
TIP: This document mostly focuses on Group Policy Object delivery of the Firefox PolicyPak AppSet. Note you may have other ways to deliver the FireFox PolicyPak AppSet like PolicyPak Cloud, local GPOs, and/or XML data files (via MSI files.) Be sure to perform this same operation using any and all methods.
You’ll want to first discover all GPOs with PolicyPak Application Settings Manager Data, and those with specific Firefox 23 AppSets. That being said, automation can only help you discover which GPOs contain PolicyPak Application Settings Manager data. After that, you must open each Group Policy Object one by one and manually look for FF23 AppSet data.
Overview of using the PolicyPak PowerShell cmdlets to discover PolicyPak data within GPOs: https://kb.policypak.com/kb/article/878-policypak-user-powershell-to-find-all-policypak-gpos/
The specific command you’ll want to run is Get-PPGPOs -cse “application settings manager”. An example result can be seen below.
Each Group Policy Object at this point will need to be opened to look for Firefox 23 AppSets. Here is an example of the FF23 AppSet on the Computer side, though it may also reside on the User side.
Before making any modifications, you’ll want to perform a few backup steps which are detailed in the next section.
There are a myriad of ways to recover from a problem during this procedure; and we recommend you perform all of these steps.
We strongly recommend before starting the upgrade that you are confident you can backup and also restore your PolicyPak Application Settings Manager and specifically the Firefox settings before continuing.
This won’t be your only backup, but it will express exactly what is in your Group Policy Object with regards to your settings.
Video is older, but gets the job done.: https://kb.policypak.com/kb/article/496-backup-restore-export-and-import/
Open each FF23 AppSet and locate the Options button. Then click Export XML Settings Data and save the file out.
A KB about this topic can be found here: https://kb.policypak.com/kb/article/396-06-what-are-the-two-ways-to-export-appset-settings-and-why-would-i-use-one-over-the-other/
Note: You will use the resulting XML file in an upcoming step and not only for backup purposes.
Additionally, you should keep handy the OLD PolicyPak Firefox 23 App Set DLL file that you are currently using; and not merely the one still available in the PolicyPak portal.
The file you are looking for is PP-Firefox23.DLL which is likely in one of three locations:
So, in summary, before leaving this section and continuing onward, again we advise that you:
Remember also you might have more than one Group Policy Object with FF23 settings, so be sure to repeat this procedure for each discovered Group Policy Object with FF23 settings.
You want to make sure that that your existing Firefox 23 AppSet policy doesn’t affect machines with the newest CSE. As of this writing the version is 23.10.3683 (October of 2023) but could be different in your download.
To play it safe, set the ILT evaluation to check for PolicyPak CSE version 23.9.0.0 (September of 2023) and earlier for FF23 and 23.10.0.0 (October of 2023) and later for FF125.
However, anything EARLIER than this version will support only FF23 AppSet and anything LATER or EQUAL to this version will support only FF115 AppSet.
Find your existing FF23 AppSet in your Group Policy Object(s) and select “Edit item-level targeting filters…”
You can test for the presence or absence of PolicyPak CSE version 23.09.0.0 with a Registry match query for:
When done save the values. You will know you have ILT set when you see the Targeting column change to ON.
Tip: Note this is different than “Predefined Targeting”. To understand the difference between ILT and Predefined Targeting watch this video. https://kb.policypak.com/kb/article/550-predefined-ilts-internal-filters/
Tip: You can also export the FF 23 settings to XMLdata File format and use part of the output to verify the Item Level Targeting will evaluate to TRUE or FALSE. To do this, right-click the entry and select Export settings to XMLData file and save the file. Then use the PolicyPak Item Level Targeting Validation tool https://kb.policypak.com/kb/article/1260-troubleshooting-ilt-with-the-ilt-validator-tool/ to test how ILT will operate. Note that you will have to trim the ILT part of the output to eliminate the <ILTFilters> at the beginning and </ILTFilters> at the end.
Expected result on a machine with 23.10 and later CSE:
After you download the FF 115 AppSet from the PolicyPak portal, it will appear like this. You only need the .DLL file and not the XML file.
Use these instructions to add the AppSet Locally or via Central Store: https://kb.policypak.com/kb/article/529-working-with-others-and-using-the-central-store/
Use these instructions to add the AppSet to a Share:
https://kb.policypak.com/kb/article/530-using-shares-to-store-your-paks-share-based-storage/
For example in the PolicyPak Central Store you simply add the pp-Mozilla Firefox 115.DLL like what’s seen as follows.
Tip: You may leave your existing pp-Mozilla Firefox 23 aboutconfig A to I and J to Z.DLL files in place without modification.
Next time you open the Group Policy editor you should see PolicyPak For Mozilla Firefox 115 like what’s seen here.
Now you can create a new entry for the FF 115 AppSet, import the previously exported FF23 settings into the FF115 AppSet and also set Item Level Targeting on the FF 115 AppSet so it only applies to computers with the latest PolicyPak CSE.
After creating the entry, double-click into it to open it up and select Import XML Settings Data.
Then select the previously exported settings from the FF 23 AppSet. You should get a SUCCESS message.
Next, set the Item-level targeting in the AppSet.
FF AppSet 115 should be applied only to machines with PolicyPak CSE version 23.10.3687 or Greater and can be determined with a Registry match query for:
Click OK and then close the AppSet entry to save it.
You can also export the FF 115 settings to XMLdata File format and use part of the output to verify the Item Level Targeting will evaluate to TRUE or FALSE. To do this, right-click the entry and select Export settings to XMLData file and save the file. Then use the PolicyPak Item Level Targeting Validation tool https://kb.policypak.com/kb/article/1260-troubleshooting-ilt-with-the-ilt-validator-tool/ to test how ILT will operate. Note that you will have to trim the ILT part of the output to eliminate the <ILTFilters> at the beginning and </ILTFilters> at the end.
You can test the ILT evaluation by using the Export settings to XMLData file for the Mozilla Firefox 115 entry.
Then you can use the ILT Evaluator tool to ensure your ILT evaluation is properly crafted and the AppSet will only target machines with the latest PolicyPak CSE.
In one of the backup steps we recommended you export the FF23 GPMC HTML report. At this point you may also want to double-check the FF115 GPMC report for any discrepancies or omissions in the export/import process.
If you don’t see an expected value this could be because (1) the FF115 Pak was updated to remove some values which appear to be unsupported in modern Firefox versions or (2) Some part of the Export from FF23 and import to FF115 didn’t work as expected.
In such a case as case 2, please manually open the FF115 Pak and manually update your settings to correct for any non-imported settings.
In this document you learned how to target the FF23 AppSet to your older CSEs and the FF115 AppSet to your newer CSEs. You also learned how to export the FF23 settings and migrate them over to the FF115 AppSet.