HowTo cook custom Firefox msi for enterprise deployment

The official position of mozilla on the msi distribution is expressed in the article . It is recommended to make FirefoxSetup.exe wrappers in msi, and any distribution of non-original distributions is also prohibited. But when using wrappers, all the advantages of msi are lost - autogeneration of rollback of changes being made, self-repair, it is more difficult to manage updates, deletions and patches. The Mozilla bug tracker bug # 231062 Provide Firefox MSI package is already 7 years old! At the same time, Chrome has support for msi and GPO built-in. It is not surprising that a third-party build from FrontMotion Firefox Community Edition also appeared for FF, which has its own features:
[+] Applies policies set via FirefoxAdm , without the help of add. extensions
[+] Has its adm / admx extensions for the GPP console.
[+] Flash plugins, IETab preinstalled
[-] Browser recompiled, and it’s not a fact that, at the same time, no new features were added to it except for GPO)
[-] The non-standard name of the shortcuts (Frontmotion Firefox) is used on the table and in the Start menu. (what else can be circumvented through transforms for msi)
[-] Another icon is used (from nightly branches) - black, which is critical for users who are looking for a red fox.
[-] Automatic updates are not applied, since its own assembly. The update channel is set to default (special channel where there are no updates)

If you are not satisfied with the minuses - it is proposed to use a paid service to build packages. I will describe how to build the package myself and get rid of the above-mentioned disadvantages.

1. We take the reference virtualka from the client OS, on which we will carry out the assembly. Run RegShot and take a snapshot of the # 1 registry.
   
2. We put the last Firefox. And we take a snapshot of the # 2 registry, close the reports, we will return to them later.
   
3. Put the plugins in FF:
   Adblock Plus - ad blocking
   IETab - allows you to open sites in the FF tabs using the IE engine. Sometimes necessary for legacy intranet sites.
   GPO for Firefox - reads policy settings from the registry of the local machine, and applies them to FF ( here is the new version 0.9.3, added the application of the new settings)
   I also added another en-US.dic spellcheck files.
   
4. Restart FF, set up Adblock on the update channel. I also moved the adblock button up, removed the statusbar and the text menu. Close FF.
   
   
5. These settings FF saved to the user profile -
   % appdata% \ Mozilla \ Firefox \ Profiles \% rnd% .default \
   Now we need to make these settings become the default settings for all new profiles. To do this, create a default profile folder
   C: \ Program Files \ Mozilla Firefox \ defaults \ profile
   and copy there from the user profile:
   - folder adblockplus, if you put an adblock
   - file localstore.rdf, if the text menu was removed or the buttons were moved
   
6. Create a prefs.js file in the default profile, and paste the following into it:
   

   user_pref("browser.shell.checkDefaultBrowser", false); user_pref("browser.startup.homepage", "ya.ru"); user_pref("browser.startup.homepage_override.mstone", "ignore"); user_pref("browser.startup.page", 3); user_pref("extensions.adblockplus.currentVersion", "1.3.9"); user_pref("extensions.ietab2.hasRun", true); user_pref("extensions.ietab2.ietab2PrefsMigrated", true); user_pref("extensions.ietab2.version", "3.5.9.1"); 

   
   Here we are trying to ensure that the first opening does not open any other tabs and greetings other than the start page and do not have a question about the default browser. Full description of all options FF here .
   
7. Now copy the plugins from the user profile, the extensions folder, to the folder
   C: \ Program Files \ Mozilla Firefox \ extensions
   A little bit about xpi plugins. Starting with version 4, they, for execution, are not necessarily unpacked into a separate folder with a unique identifier. And they can remain in their original form. Therefore, in the plugins folder you see a mixture of folders and xpi files. When copying to the Mozilla Firefox \ extensions folder, the plugin is installed globally. Previously, this had to be done
   firefox.exe -install-global-extension "% path-to-extension% \ extname.xpi"
   You can read more - here .
   
8. After copying plug-ins, you need to check their compatibility with the FF version. To do this, you must open the install.rdf file in each and see the <em: maxVersion> parameter . I corrected the incompatible ones to 99. You need to open xpi plugins as a zip archive and also check and fix the install.rdf file inside as necessary.
   
9. Now we erase the user profile, the entire folder.
   % appdata% \ Mozilla \ Firefox \
   and run FF. We need to ensure that it opens without unnecessary tabs and questions. The panels and menus were in the order we set, and all the added plugins were connected. If the welcome tab of any plug-in opens, find the line in the prefs.js file, which determines that this plug-in has not yet started, and copy it to the default profile.
   
10. But after each erasing the % appdata% \ Mozilla \ Firefox \ folder and launching the browser, you are prompted to import the bookmarks. To disable this, create a file.
    C: \ Program Files \ Mozilla Firefox \ override.ini
    with content:
    [XRE]
EnableProfileMigrator=false
    
11. After you have started the first launch of the browser with an empty profile, you can proceed to the package in msi. Run the wItem Installer and create a new project. We fill in the information on the General Info tab and select the installation of shortcuts for all users, not the current one.
    
    
12. On the Files tab, drag-n-drop all the content from our folder C: \ Program Files \ Mozilla Firefox \
    
13. On the Shortcuts tab, create New shortcut for a file from the installation for the Desktop and Start Menu \ Programs folders leading to firefox.exe
    
14. On the Registry tab, we do Import from a .reg file . But for this you need to prepare it. We return to the reports from RegShot, take * Redo.reg , open it with a notepad and clean off unnecessary entries.
    If it is necessary to make FF the default browser for all users of the computer, then replace all occurrences of HKEY_CURRENT_USER with HKEY_LOCAL_MACHINE .
    We also replace all occurrences of C: \\ Program Files \\ Mozilla Firefox with % AppDir% so that the final folder name is entered after installation
    Another wItem takes a bit differently .reg files, so we also replace all \ " with "
    I got this file - pastebin.com/fGjsH8n4
    
15. On the Custom Actions tab, add such a task to register AccessibleMarshal.dll
    
    
16. Build on the Create Setup tab. There should be no Error, even the software version indicated in the wrong format will uninstall msi.
    
17. We take adm \ admx files , add GPP / PolicyDefinitions folder to the console, and configure the necessary browser settings. For example, single sign-on ntlm (entry through the current domain account for the intranet) - network.automatic-ntlm-auth.trusted-uris
    
18. In order for the browser auto-update to work under the user, you must give the rights to the folder
    % ProgramFiles% \ Mozilla Firefox
    This can be done both through GPO (Windows Configuration \ Security Settings \ File System), and with the help of Custom Actions, after the installation is completed. For example:
    

     cacls "%AppDir%" /t /e /p "builtin\":C cacls "%AppDir%" /t /e /p "builtin\users":C 

    
    

PS
* I changed firefox.adm a bit, added parameters for setting folder opening using links like file: /// o: \ folder \ file for network drives and intranet, as described here , but to apply the settings in FF, you need a GPO v0.9.3 plugin
** Ready firefox.msi can be downloaded here (for personal educational purposes only)

upd1: Updated GPO for Firefox plugin. Did not apply settings that are not yet in prefs and he cannot recognize their type. Now applies as char to the default.