Skip to main content
Sign in
Deutsch Español Français Italiano

Whitelisting domains on Mozilla Firefox via Windows GPO

This configuration prevents Safe Browsing warnings on Mozilla Firefox during phishing simulation campaigns. It uses Group Policy Objects in Active Directory.

Unlike Chrome and Edge, Firefox does not apply the urlclassifier.skipHostnames preference if distributed via Registry/Preferences GPO (the preference appears in about:policies but not in about:config on Firefox 140+). The only working method is to write a user.js file directly in the user profile folder, distributed via a PowerShell script as a Startup Script of the GPO.

Prerequisites

  • Active Directory Domain Services (AD DS) running
  • Domain Admin credentials
  • Mozilla Firefox installed on clients (version 102 ESR or later)
  • Access to Group Policy Management Console (gpmc.msc)
  • Ability to enable PowerShell script execution via GPO

ℹ️ Note: For this configuration, Firefox ADMX templates are not required. The urlclassifier.skipHostnames preference is managed entirely via a PowerShell script that writes the user.js file in user profiles.

Step 1: Enable PowerShell script execution via GPO

By default, Windows blocks the execution of unsigned PowerShell scripts. Without this configuration, the whitelist script will not run.

  1. Open Group Policy Management Console (gpmc.msc)
  2. Create or modify the target GPO (see Step 2 to create it)
  3. Navigate to:
Computer Configuration → Policies → Administrative Templates
→ Windows Components → Windows PowerShell
  1. Open Turn on Script Execution → Select Enabled → Choose Allow all scripts → OK
  2. Go back to:
Computer Configuration → Policies → Administrative Templates
→ System → Scripts
  1. Open Allow logon scripts when NetBIOS or WINS is disabled → Enabled → OK
  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to the target OU (Organizational Unit)
  3. Right-click on OU → Create a GPO in this domain, and Link it here
  4. Type the name: Cyber Guru SafeBrowsing Whitelist - Firefox
  5. Click OK

Step 3: Create the PowerShell script and copy it to SYSVOL

The script writes the user.js file in all Firefox profiles of all users on the client. It must be stored in the SYSVOL folder of the GPO (NOT in a local path on the Domain Controller, otherwise clients will not be able to reach it).

  1. From the GPMC console, right-click on the GPO Cyber Guru SafeBrowsing Whitelist - Firefox → Edit
  2. Navigate to:
Computer Configuration → Policies → Windows Settings → Scripts (Startup/Shutdown)
  1. Double-click on Startup → Click the PowerShell Scripts tab → Click Show Files...
  2. The SYSVOL folder of the GPO will open (e.g. \\<domain>\SysVol\<domain>\Policies\{GUID}\Machine\Scripts\Startup\)
  3. In this folder, create a new file named CyberGuru_Firefox_SafeBrowsing.ps1 with the following content:
# CyberGuru_Firefox_SafeBrowsing.ps1
# Distributes user.js in all Firefox profiles of all users

$logFile = "C:\Windows\Temp\CyberGuru_Firefox.log"
$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
Add-Content -Path $logFile -Value "--- Execution: $timestamp ---"

$domini = '10eurodisconto.com,admin-help.info,agenziaesattoriale.it,amazonn.cloud,amazonws.it,antifrodi.it,apple-cl0ud.com,bn-k.eu,bn-k.org,bolletta-digitale.it,bulanmisa.com,comunicazioni-sicure.it,courierxpress.eu,cyberguru.eu,cyberguru.it,dropcloud.it,er9.es,er9.eu,er9.it,faceb00k.it,fast-shipping.it,fotocloud.net,g0ogle.eu,go0gle.store,goolge-secure.com,human-resource.tech,icloud-secure.eu,iscrizionigratuite.it,lnkedin.eu,macrosotf.com,mastercardz.com,netfliix.org,newsupdate.cloud,oultook.cloud,pagamenti-f24.it,remote-otp.com,security-service.cloud,securetracking.online,spotfy.org,telecomunicazioniitaliane.it,tribunaleroma.eu,urgente.eu,w0rld.info'

$userJsContent = 'user_pref("urlclassifier.skipHostnames", "' + $domini + '");'

Get-ChildItem "C:\Users" -Directory | ForEach-Object {
    $profilesDir = Join-Path $_.FullName "AppData\Roaming\Mozilla\Firefox\Profiles"
    if (Test-Path $profilesDir) {
        Get-ChildItem $profilesDir -Directory -Filter "*.default*" | ForEach-Object {
            $userJs = Join-Path $_.FullName "user.js"
            try {
                Set-Content -Path $userJs -Value $userJsContent -Force
                Add-Content -Path $logFile -Value "OK: $userJs"
            } catch {
                Add-Content -Path $logFile -Value "ERROR: $userJs - $_"
            }
        }
    }
}

Add-Content -Path $logFile -Value "--- End ---"
  1. Return to the Startup Properties window → Click Add... → Browse... → Select CyberGuru_Firefox_SafeBrowsing.ps1 from the path \\<domain>\SysVol\<domain>\Policies\{GUID}\Machine\Scripts\Startup\ just created.
  2. Click OK twice to save

⚠️ IMPORTANT: The .ps1 file must be located in the SYSVOL folder opened from "Show Files...". If a local DC path is referenced (e.g. C:\Users\Administrator\Downloads\firefox.ps1), clients will not be able to reach it and the script will not run.

Step 4: Verification on endpoint

  1. On a Windows client with Firefox installed, apply the policy and restart the PC (the Startup Script runs only at boot, gpupdate /force does not re-run it):
gpupdate /force
shutdown /r /t 0
  1. After restart, verify that the script has been executed by opening:
C:\Windows\Temp\CyberGuru_Firefox.log

Lines like OK: C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>.default-release\user.js should appear

  1. Open Firefox and navigate to:
about:config

Search for urlclassifier.skipHostnames — it must contain the list of 43 Cyber Guru domains.

  1. Navigate to a whitelisted domain (e.g. dropcloud.it) → no red Safe Browsing warning.

Troubleshooting

urlclassifier.skipHostnames appears in about:policies but NOT in about:config:

  • The Registry/Preferences GPO method does not work on Firefox 140+. You must use the PowerShell script with user.js (Step 3)
  • Verify that the user.js file exists in the profile in use (check which one is active from about:profiles)
  • Close Firefox completely (also from Task Manager) and reopen it

The PowerShell script does not run (log missing):

  • Verify that .ps1 has been copied to the SYSVOL folder of the GPO (not to local DC paths). Reopen "Show Files..." to check
  • Verify that the Execution Policy has been enabled via GPO (Step 1)
  • gpupdate /force reloads policies but does not re-run Startup Scripts: a full client restart is required
  • Run gpresult /h report.html on the client to confirm that the GPO is applied

The script runs but user.js is not written:

  • The script runs as SYSTEM: $env:APPDATA points to the system profile, not user profiles. The provided script (Step 3) correctly scans C:\Users\ for each profile
  • Verify permissions on user folders (normally SYSTEM has full access)

Safe Browsing warnings still present on subdomains:

  • urlclassifier.skipHostnames requires exact domain match. Add specific subdomains to the list (e.g. ciao.dropcloud.it)

user.js exists but is ignored:

  • Verify that Firefox has been completely closed before opening. The user.js is read only at startup
  • Verify that the modified profile is actually the one in use (about:profiles → "This is the profile in use")