1

I've installed Mozilla Thunderbird 31.3.0 on a Windows Server 2012 R2 which has the Remote Desktop Services role.

I want to configure the Thunderbird program and set each user's email account etc and then I need to lockdown the program, so that users cannot make any changes.

I've been googling trying to figure out how i can prevent users from making any preferences settings and the only thing related to GPO that I can find it this, but I'm hesitant to use it.

Is there something official from Mozilla on how to do this?

I don't need to be specific about what I lockdown, so I'd be happy to just disable all preferences/settings in one go if that is easier.

UPDATE

Looks like I might have found a starting point here

Slipeer
  • 3,255
  • 2
  • 18
  • 32
hydrajump
  • 63
  • 1
  • 2
  • 7

1 Answers1

0

Because you're working with a non-Microsoft program, there's no built-in way of controlling settings and preferences. In this case, you have to write your own.

Creating a custom policy object for a third party application is fairly straightforward. Applications store settings in two places: files and registry keys. All you need to do is find where the setting you need to control is stored, and then create either a GP Files Preferences or GP Registry Preferences item to modify that location. Actually creating the policy is super-easy - finding the location is the tricky part.

Part 1: Finding a setting's location

If you're lucky, the application developer may have made this easy. Open up registry editor and find the application's key under HKLM\Software or HKCU\Software, then look for a key/value pair that sounds relevant. About half of the time, they jump right out at you (e.x. you're looking to skip a first run wizard, and there's a key called FirstRun). You can also try looking in an application's directory under %AppData% for obvious files (e.x. UserPreferences.ini)

If you can't find any obvious settings, you'll need some assistance. Download Process Monitor from Microsoft's site here. It takes a bit of getting used to, but you can see every operation a program does. Every persistent setting has to be saved somewhere, and saving a setting means that either a file or a registry key gets written to. Start your application, start Process Monitor, filter your scope to that application, make the change, and watch to see what gets written to. From there, you'll know where the application is storing settings.

Either way, you can confirm your findings by watching the location as you change the setting in the application. If you've found the right location, you'll be able to see it change. Do note that not all applications write out settings immediately - some batch them, and some wait until you close the program or otherwise explicitly press save.

Part 2: Creating a policy for deployment

If you found a registry key that's being modified, use Group Policy Registry Preferences to adjust the key value to whatever you want. Registry keys are easy.

If you found a file, you can use Group Policy Files Preferences to replace that file on target systems with a version you configure. For example: Set your preferences the way you want them, copy the file to a network share, and use GPP Files to replace the file on target systems with your version. Group Policy has no capability to work with individual settings in a file - it's all or nothing. If your application stores user-specific attributes in it's preferences file, you're out of luck.

I've customized hundreds of applications in my environment by following this basic process. You can do everything from skipping first run wizards to personalizing an application with data from each user's active directory information. About half the time, you get lucky, and the settings are obvious. Customizing and integrating applications through Group Policy is an incredibly useful and powerful tool to have at your disposal, especially because it's already there and doesn't cost anything.

tfrederick74656
  • 1,442
  • 1
  • 12
  • 29