#-------------------------------- # GOOGLE CHROME SECURITY SETTINGS #-------------------------------- chrome_safe_browsing_options = 2 chrome_HTTPS_Only_Mode_options = 1 chrome_PasswordLeakDetection_options = 1 chrome_Incognito_options = 0 #-------------------------------- # MICROSOFT EDGE SECURITY SETTINGS #-------------------------------- TrackingPrevention_options = 3 EnhanceSecurityMode_options = 2 MD_SmartScreen_options = 1 BlockPotentiallyUnwantedApps_options = 1 WebsiteTypoProtection_options = 1 SiteSafetyServices_options = 1 Scareware_Blocker_options = 1 Edge_HTTPS_Only_Mode_options = 1 edge_InPrivate_options = 0 FakeMDMEnrollment_options = 1 #-------------------------------- # FIREFOX SECURITY SETTINGS #-------------------------------- EnableTrackingProtection_options = 1 Https_Only_Mode_options = 1 SafeBrowsing_options = 1 PrivateBrowsing_options = 1 #-------------------------------- # PYTHON SCRIPT STARTS #-------------------------------- import os from subprocess import PIPE, Popen import ctypes FAKE_GUID = "FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF" ENROLL_KEY = "HKLM\\SOFTWARE\\Microsoft\\Enrollments\\%s" % FAKE_GUID OMADM_KEY = "HKLM\\SOFTWARE\\Microsoft\\Provisioning\\OMADM\\Accounts\\%s" % FAKE_GUID class BrowserSettings: class disable_file_system_redirection: _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection def __enter__(self): self.old_value = ctypes.c_long() self.success = self._disable(ctypes.byref(self.old_value)) def __exit__(self, type, value, traceback): if self.success: self._revert(self.old_value) def ecmd(self, command): with self.disable_file_system_redirection(): return Popen(command, shell=True, stdout=PIPE, stderr=PIPE).communicate() #-------------------------------- # DEVICE MANAGEMENT STATE (for SmartScreen sensitive policies) #-------------------------------- def is_managed(self): out, _ = self.ecmd("dsregcmd /status") try: text = out.decode("utf-8", "ignore") except Exception: text = str(out) for line in text.splitlines(): l = line.strip() for key in ("AzureAdJoined", "EnterpriseJoined", "DomainJoined"): if l.startswith(key) and ":" in l and l.split(":")[-1].strip().upper() == "YES": return True return False def apply_fake_enrollment(self): self.ecmd('REG ADD "%s" /v EnrollmentState /t REG_DWORD /d 1 /f' % ENROLL_KEY) self.ecmd('REG ADD "%s" /v EnrollmentType /t REG_DWORD /d 0 /f' % ENROLL_KEY) self.ecmd('REG ADD "%s" /v IsFederated /t REG_DWORD /d 0 /f' % ENROLL_KEY) self.ecmd('REG ADD "%s" /v Flags /t REG_DWORD /d 0x00d6fb7f /f' % OMADM_KEY) print("Applied device-management marker (workgroup device).") #-------------------------------- # CHROME #-------------------------------- def chrome_settings(self): print(self.ecmd( 'REG ADD HKLM\\Software\\Policies\\Google\\Chrome /v SafeBrowsingProtectionLevel ' '/t REG_DWORD /d %s /f' % chrome_safe_browsing_options )) if chrome_HTTPS_Only_Mode_options == 0: print(self.ecmd( 'REG ADD HKLM\\Software\\Policies\\Google\\Chrome /v HttpsOnlyMode ' '/t REG_SZ /d disallowed /f' )) else: print(self.ecmd( 'REG ADD HKLM\\Software\\Policies\\Google\\Chrome /v HttpsOnlyMode ' '/t REG_SZ /d force_enabled /f' )) print(self.ecmd( 'REG ADD HKLM\\Software\\Policies\\Google\\Chrome /v PasswordLeakDetectionEnabled ' '/t REG_DWORD /d %s /f' % chrome_PasswordLeakDetection_options )) # NEW: Incognito mode (0=available, 1=disabled) print(self.ecmd( 'REG ADD HKLM\\Software\\Policies\\Google\\Chrome /v IncognitoModeAvailability ' '/t REG_DWORD /d %s /f' % chrome_Incognito_options )) #-------------------------------- # EDGE #-------------------------------- def Edge_settings(self): edge_path = "HKLM\\Software\\Policies\\Microsoft\\Edge" print(self.ecmd( 'REG ADD %s /v TrackingPrevention /t REG_DWORD /d %s /f' % (edge_path, TrackingPrevention_options) )) print(self.ecmd( 'REG ADD %s /v EnhanceSecurityMode /t REG_DWORD /d %s /f' % (edge_path, EnhanceSecurityMode_options) )) print(self.ecmd( 'REG ADD %s /v TyposquattingCheckerEnabled /t REG_DWORD /d %s /f' % (edge_path, WebsiteTypoProtection_options) )) print(self.ecmd( 'REG ADD %s /v SiteSafetyServicesEnabled /t REG_DWORD /d %s /f' % (edge_path, SiteSafetyServices_options) )) # --------------------------- # HTTPS-ONLY MODE (Edge UI shows "Automatically switch to more secure connections") # --------------------------- if Edge_HTTPS_Only_Mode_options == 0: edge_https_value = "disallowed" elif Edge_HTTPS_Only_Mode_options == 2: edge_https_value = "force_balanced_enabled" else: edge_https_value = "force_enabled" print(self.ecmd( 'REG ADD %s /v HttpsOnlyMode /t REG_SZ /d %s /f' % (edge_path, edge_https_value) )) # --------------------------- # SCAREWARE BLOCKER (GLOBAL) # --------------------------- print(self.ecmd( 'REG ADD %s /v ScarewareBlockerProtectionEnabled /t REG_DWORD /d %s /f' % (edge_path, Scareware_Blocker_options) )) print(self.ecmd( 'REG ADD %s /v ScarewareBlockerBlocksDetectedSitesEnabled /t REG_DWORD /d %s /f' % (edge_path, Scareware_Blocker_options) )) print(self.ecmd( 'REG ADD %s /v InPrivateModeAvailability /t REG_DWORD /d %s /f' % (edge_path, edge_InPrivate_options) )) print(self.ecmd( 'REG ADD %s /v SmartScreenEnabled /t REG_DWORD /d %s /f' % (edge_path, MD_SmartScreen_options) )) print(self.ecmd( 'REG ADD %s /v SmartScreenPuaEnabled /t REG_DWORD /d %s /f' % (edge_path, BlockPotentiallyUnwantedApps_options) )) #-------------------------------- # FIREFOX #-------------------------------- def Firefox_settings(self): print(self.ecmd( 'REG ADD HKLM\\Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection ' '/v Value /t REG_DWORD /d %s /f' % EnableTrackingProtection_options )) print(self.ecmd( 'REG ADD HKLM\\Software\\Policies\\Mozilla\\Firefox\\Preferences ' '/v dom.security.https_only_mode /t REG_DWORD /d %s /f' % Https_Only_Mode_options )) prefs = [ "browser.safebrowsing.phishing.enabled", "browser.safebrowsing.malware.enabled", "browser.safebrowsing.downloads.enabled", "browser.safebrowsing.downloads.remote.block_uncommon", "browser.safebrowsing.downloads.remote.block_potentially_unwanted" ] for p in prefs: print(self.ecmd( 'REG ADD HKLM\\Software\\Policies\\Mozilla\\Firefox\\Preferences ' '/v %s /t REG_DWORD /d %s /f' % (p, SafeBrowsing_options) )) print(self.ecmd( 'REG ADD HKLM\\Software\\Policies\\Mozilla\\Firefox ' '/v DisablePrivateBrowsing /t REG_DWORD /d %s /f' % PrivateBrowsing_options )) #-------------------------------- # RUN EVERYTHING #-------------------------------- def change_settings(self): managed = self.is_managed() print("Device managed (domain/Entra/MDM): %s" % managed) if FakeMDMEnrollment_options == 2 or (FakeMDMEnrollment_options == 1 and not managed): self.apply_fake_enrollment() self.chrome_settings() self.Edge_settings() self.Firefox_settings() # Edge must be fully closed for policies to take effect. self.ecmd("taskkill /f /im msedge.exe") browserOBJ = BrowserSettings() browserOBJ.change_settings()