Tip: This document is only needed for customers using PolicyPak Application Settings Manager and Firefox ESR. There is no required special workaround for PolicyPak Browser Router except using the latest PolicyPak CSE and Firefox ESR 115 and later.

Firefox 115 and later has made a breaking change internally which makes our longstanding plug-in implementation fail to operate. This change is expected to be permanent, and as such required a few items to workaround and fix it:

• Changes within PolicyPak Application Settings Manager on how we register the Firefox plug in (requiring an updated CSE)
• The way the AppSet performs its interaction with the CSE
• The AppSet itself which needed to be recompiled with some PolicyPak DesignStudio updates.

Tip: If you are using the PolicyPak DesignStudio yourself to make any changes to the Firefox 23 AppSet, you will need to re-compile with the latest PolicyPak DesignStudio and then perform the steps listed below.

This document is to help guide you through the required transition.

We will refer to the original Firefox AppSet as FF23 AppSet and the updated one as Firefox AppSet as FF115.

You can acquire the updated FireFox AppSet 115 in the PolicyPak Portal within the AppSets downloads.

Tip: It is recommended, though not strictly required that you also update your management station to the latest PolicyPak MMC snap-in. In doing so the screenshots shown here will match the steps you will be performing.

Functional Matrix of Firefox, CSE and AppSet

 

Firefox ESR version	CSE Version	AppSet Version Compiled with	Expected Behavior
102.9 and below	23.8 and below	23.8 and below (aka FF23 AppSet)	Works
102.9 and below	23.10 and later	23.10 and later (aka FF 115 AppSet)	Works
102.9 and below	23.8 and below	23.10 and later (aka FF 115 AppSet)	Not Work
115 and later	23.10 and later	23.8 and below (aka FF23 AppSet)	Not Work
115 and later	23.8 and below	23.10 and later (aka FF 115 AppSet)	Not Work
115 and later	23.10 and later	23.10 and later (aka FF23 AppSet)	Works

 

The upshot is:

• If you use the new CSE you must use the New AppSet (FF115).
• If you use an older CSE you must use the Older AppSet (FF23).
• Then when you use the new CSE and the New AppSet (FF115), PolicyPak will operate as expected for FF ESR version 102.9 and also FF 115 and later.

Additionally, you will want to ensure that your existing FF23 AppSet policies do not get pushed  down to the machines with the new 23.10 and later CSE. During this guide you will use Item Level Targeting to ensure that the older FF23 AppSet cannot work with, and shouldn’t be applied to newer CSEs; therefore we need to ensure that the newer FF115 AppSet only applies to the newer CSEs.

TIP: This document mostly focuses on Group Policy Object delivery of the Firefox PolicyPak AppSet. Note you may have other ways to deliver the FireFox PolicyPak AppSet like PolicyPak Cloud, local GPOs, and/or XML data files (via MSI files.) Be sure to perform this same operation using any and all methods.

Finding all GPOs with PolicyPak Application Settings Manager Data

You’ll want to first discover all GPOs with PolicyPak Application Settings Manager Data, and those with specific Firefox 23 AppSets. That being said, automation can only help you discover which GPOs contain PolicyPak Application Settings Manager data. After that, you must open each Group Policy Object one by one and manually look for FF23 AppSet data.

Overview of using the PolicyPak PowerShell cmdlets to discover PolicyPak data within GPOs: https://kb.policypak.com/kb/article/878-policypak-user-powershell-to-find-all-policypak-gpos/

The specific command you’ll want to run is Get-PPGPOs -cse “application settings manager”. An example result can be seen below.

 

Each Group Policy Object at this point will need to be opened to look for Firefox 23 AppSets. Here is an example of the FF23 AppSet on the Computer side, though it may also reside on the User side.

Before making any modifications, you’ll want to perform a few backup steps which are detailed in the next section.

Backing Up and Testing a Restore

There are a myriad of ways to recover from a problem during this procedure; and we recommend you perform all of these steps.

We strongly recommend before starting the upgrade that you are confident you can backup and also restore your PolicyPak Application Settings Manager and specifically the Firefox settings before continuing.

Back up 1: Viewing the Group Policy Object Report and saving the HTML report.

This won’t be your only backup, but it will express exactly what is in your Group Policy Object with regards to your settings.

Back Up 2: Backing up the Group Policy Object (or all GPOs.) 

Video is older, but gets the job done.: https://kb.policypak.com/kb/article/496-backup-restore-export-and-import/

Back up 3: Export the settings for each FF23 AppSet you already have.

Open each FF23 AppSet and locate the Options button. Then click Export XML Settings Data and save the file out.

A KB about this topic can be found here: https://kb.policypak.com/kb/article/396-06-what-are-the-two-ways-to-export-appset-settings-and-why-would-i-use-one-over-the-other/

Note: You will use the resulting XML file in an upcoming step and not only for backup purposes.

Back up 4: Backing up your Firefox 23 AppSet DLL 

Additionally, you should keep handy the OLD PolicyPak Firefox 23 App Set DLL file that you are currently using; and not merely the one still available in the PolicyPak portal. 

The file you are looking for is PP-Firefox23.DLL which is likely in one of three locations:

• \Programfiles\PolicyPak\Extensions or
• SYSVOL (replicated to other domain controllers)\ C:\Windows\SYSVOL\sysvol\fabrikam.com\Policies\PolicyPak
• A share. (Tip: To locate the share you could be using watch this video: https://kb.policypak.com/kb/article/530using-shares-to-store-your-paks-share-based-storage/)

So, in summary, before leaving this section and continuing onward, again we advise that you:

1. Have an HTML report of your existing FF23 settings.
2. Have a backup of the GPO or GPOs which may potentially need to be restored.
3. Have your exported FF23 AppSet settings XML as per the instructions.
4. Have your PP-Firefox23.DLL handy that you are already using.

Remember also you might have more than one Group Policy Object with FF23 settings, so be sure to repeat this procedure for each discovered Group Policy Object with FF23 settings.

Adding Item Level Targeting to your Existing FF 23 AppSet policy entry (and optionally testing the ILT evaluation)

You want to make sure that that your existing Firefox 23 AppSet policy doesn’t affect machines with the newest CSE. As of this writing the version is 23.10.3683 (October of 2023) but could be different in your download.

To play it safe, set the ILT evaluation to check for PolicyPak CSE version 23.9.0.0 (September of 2023) and earlier for FF23 and 23.10.0.0 (October of 2023) and later for FF125.

However, anything EARLIER than this version will support only FF23 AppSet and anything LATER or EQUAL to this version will support only FF115 AppSet.

Find your existing FF23 AppSet in your Group Policy Object(s) and select “Edit item-level targeting filters…”

You can test for the presence or absence of PolicyPak CSE version 23.09.0.0 with a Registry match query for:

• Match type: Match value data
• Value data match type: Version match
• Hive: HKEY_Local_Machine
• Key Path: SOFTWARE\PolicyPak\ClientSide Extensions\{F8357AE4-F4E0-49EC-AE9D-61078938E7CD}
• Value Name: Version
• Value Type: REG_SZ
• Version Range: GREATER THAN 0.0.0.0 and LESS THAN 23.9.0.0

When done save the values. You will know you have ILT set when you see the Targeting column change to ON. 

Tip: Note this is different than “Predefined Targeting”. To understand the difference between ILT and Predefined Targeting watch this video. https://kb.policypak.com/kb/article/550-predefined-ilts-internal-filters/

Optional: Testing the ILT Filters on FF23 using the PolicyPak Item Level Targeting Validation Tool

Tip: You can also export the FF 23 settings to XMLdata File format and use part of the output to verify the Item Level Targeting will evaluate to TRUE or FALSE. To do this, right-click the entry and select Export settings to XMLData file and save the file. Then use the PolicyPak Item Level Targeting Validation tool https://kb.policypak.com/kb/article/1260-troubleshooting-ilt-with-the-ilt-validator-tool/ to test how ILT will operate. Note that you will have to trim the ILT part of the output to eliminate the <ILTFilters> at the beginning and </ILTFilters> at the end.

Expected result on a machine with 23.10 and later CSE:

Adding the FF 115 AppSet to an existing or new Group Policy Object

After you download the FF 115 AppSet from the PolicyPak portal, it will appear like this. You only need the .DLL file and not the XML file.

Use these instructions to add the AppSet Locally or via Central Store: https://kb.policypak.com/kb/article/529-working-with-others-and-using-the-central-store/

Use these instructions to add the AppSet to a Share:

https://kb.policypak.com/kb/article/530-using-shares-to-store-your-paks-share-based-storage/

For example in the PolicyPak Central Store you simply add the pp-Mozilla Firefox 115.DLL like what’s seen as follows.

Tip: You may leave your existing pp-Mozilla Firefox 23 aboutconfig A to I and J to Z.DLL files in place without modification.

Next time you open the Group Policy editor you should see PolicyPak For Mozilla Firefox 115 like what’s seen here.

 

Using the FF 115 AppSet

Now you can create a new entry for the FF 115 AppSet, import the previously exported FF23 settings into the FF115 AppSet and also set Item Level Targeting on the FF 115 AppSet so it only applies to computers with the latest PolicyPak CSE.

After creating the entry, double-click into it to open it up and select Import XML Settings Data.

Then select the previously exported settings from the FF 23 AppSet. You should get a SUCCESS message.

Next, set the Item-level targeting in the AppSet.

 

FF AppSet 115 should be applied only to machines with PolicyPak CSE version 23.10.3687 or Greater and can be determined with a Registry match query for:

• Match type: Match value data
• Value data match type: Version match
• Hive: HKEY_Local_Machine
• Key Path: SOFTWARE\PolicyPak\ClientSide Extensions\{F8357AE4-F4E0-49EC-AE9D-61078938E7CD}
• Value Name: Version
• Value Type: REG_SZ
• Version Range: GREATER THAN OR EQUAL TO 23.10.0.0 and LESS THAN 99.0.0.0

Click OK and then close the AppSet entry to save it.

Optional: Testing the ILT Filters on FF23 using the PolicyPak Item Level Targeting Validation Tool

You can also export the FF 115 settings to XMLdata File format and use part of the output to verify the Item Level Targeting will evaluate to TRUE or FALSE. To do this, right-click the entry and select Export settings to XMLData file and save the file. Then use the PolicyPak Item Level Targeting Validation tool https://kb.policypak.com/kb/article/1260-troubleshooting-ilt-with-the-ilt-validator-tool/ to test how ILT will operate. Note that you will have to trim the ILT part of the output to eliminate the <ILTFilters> at the beginning and </ILTFilters> at the end.

You can test the ILT evaluation by using the Export settings to XMLData file for the Mozilla Firefox 115 entry.

Then you can use the ILT Evaluator tool to ensure your ILT evaluation is properly crafted and the AppSet will only target machines with the latest PolicyPak CSE.

HTML Settings Report Manual Comparison

In one of the backup steps we recommended you export the FF23 GPMC HTML report.  At this point you may also want to double-check the FF115 GPMC report for any discrepancies or omissions in the export/import process.

If you don’t see an expected value this could be because (1) the FF115 Pak was updated to remove some values which appear to be unsupported in modern Firefox versions or (2) Some part of the Export from FF23 and import to FF115 didn’t work as expected.

In such a case as case 2, please manually open the FF115 Pak and manually update your settings to correct for any non-imported settings.

Final Thoughts

In this document you learned how to target the FF23 AppSet to your older CSEs and the FF115 AppSet to your newer CSEs. You also learned how to export the FF23 settings and migrate them over to the FF115 AppSet.