Lockdown Firefox updates on Microsoft Terminal Server

I had an interesting dilemma today.

Due to the way some of our internal applications and certain brands of network gear function, our NOC requires Mozilla Firefox on the terminal servers. Over the weekend an update must’ve come out for Firefox, and a user clicked OK.

The update crapped out halfway through since they didn’t have administrative rights. Firefox doesn’t appear to roll back in this situation, leaving you with a broken install. So broken that you can’t even uninstall it without getting the dreaded: “Your computer must be restarted to complete a previous upgrade of Firefox. Do you want to reboot now?” which is also what it says when a user tries to open it.

Sure would be nice if the developers of Firefox threw in a privileges sanity check.

We need a two phased approach to fix this fiasco.

Fix #1: Get rid of that obnoxious error.

Lucky for me, a co-worker of mine has ran into this before and has the fix documented on his blog here:

http://blog.acrile.com/2008/12/your-computer-must-be-restarted-to.html

Long story short: delete the *.moz-upgrade and *.moz-delete files from Firefox folder. Now that the error is gone, I went ahead and uninstalled/reinstalled Firefox just to make sure nothing dirty was left behind.

Fix #2: Disable the auto-update feature in Firefox.

I accomplished this by first creating a file called mozilla.cfg in the C:Program FilesMozilla Firefox directory with the following contents:

// Disable Auto Updates
lockPref(”app.update.enabled”, false);
lockPref(”extensions.update.enabled”, false);

Those instruct Firefox to disable the auto update for the browser itself AND any add-in extensions.

Also you must edit C:Program FilesMozilla Firefoxgreprefs edit the file all.js and add this to the bottom:

// Process mozilla.cfg in FireFox root directory.
pref(”general.config.obscure_value”, 0);
pref(”general.config.filename”, “mozilla.cfg”);

Without that last piece, Firefox won’t process the mozilla.cfg you created.

No reboot needed, and hopefully you’ll never run into this again.

Later on I found a nice website that lists many other features an administrator might want to enforce in a terminal server environment. Check them out here:

http://www.pcc-services.com/kixtart/firefox-lockdown.html

Till next time…