Script to Configure Browser Security Settings

Download JSON Download Python

Ratings

Release Time

12/13/2023

Downloads

1173 times

Update Time

11/02/2026

Views

3839 times

Share-it:

Tags

browser

RUN AS LOCALSYSTEM USER

Please use this script to configure security settings in Google Chrome, Microsoft Edge, and Mozilla Firefox.

This script has been scanned with Virustotal.com and Xcitium Verdict Cloud.

PYTHON SCRIPT FILE SHA1 VALUE - 42af9200bb4f62bcbefbd35f6d3f201ccec12a74

JSON FILE SHA1 VALUE - 2fc34b0c468d143946add9d84aafc6f90c62a573

NOTE:

IMPORTANT - BROWSER RESTART:
When this script finishes, it force-closes Microsoft Edge, Google Chrome and Mozilla Firefox (taskkill) so the new settings apply immediately. Any open browser windows/tabs will close without saving.
Run this during a maintenance window or when the browsers are not in active use.

GOOGLE CHROME:

1. Safe browsing

give 0 in the chrome_safe_browsing_options if you want to set the safe browsing to "NO PROTECTION"
give 1 in the chrome_safe_browsing_options if you want to set the safe browsing to "STANDARD PROTECTION"
give 2 in the chrome_safe_browsing_options if you want to set the safe browsing to "ENHANCED PROTECTION"

2. Always use secure connections

give 0 in the chrome_HTTPS_Only_Mode_options if you do not want to allow users to enable "Always use secure connections"
give 1 in the chrome_HTTPS_Only_Mode_options if you want to enable "Always use secure connections"

3. Warn if a password was compromised in a data breach

give 0 in the chrome_PasswordLeakDetection_options to disable
give 1 in the chrome_PasswordLeakDetection_options to enable

4. Incognito mode

give 0 in the chrome_Incognito_options if you want to allow "Incognito mode"
give 1 in the chrome_Incognito_options if you want to disable "Incognito mode"

MICROSOFT EDGE:

1. TrackingPrevention:

give 0 in the TrackingPrevention_options if you want to set the TrackingPrevention to "disable"
give 1 in the TrackingPrevention_options if you want to set the TrackingPrevention to "Basic"
give 2 in the TrackingPrevention_options if you want to set the TrackingPrevention to "Balanced"
give 3 in the TrackingPrevention_options if you want to set the TrackingPrevention to "Strict"

2. Enhance your security on the web:

give 0 in the EnhanceSecurityMode_options if you want to set "Enhance your security on the web" to "disable"
give 1 in the EnhanceSecurityMode_options if you want to set "Enhance your security on the web" to "Balanced"
give 2 in the EnhanceSecurityMode_options if you want to set "Enhance your security on the web" to "Strict"

3. Microsoft Defender SmartScreen:

give 0 in the MD_SmartScreen_options if you want to disable "Microsoft Defender SmartScreen"
give 1 in the MD_SmartScreen_options if you want to enable "Microsoft Defender SmartScreen"

4. Block potentially unwanted apps:

you need to enable Microsoft Defender SmartScreen in order to use this option.

give 0 in the BlockPotentiallyUnwantedApps_options if you want to disable "block potentially unwanted apps"
give 1 in the BlockPotentiallyUnwantedApps_options if you want to enable "block potentially unwanted apps"

5. Website typo protection:

give 0 in the WebsiteTypoProtection_options if you want to disable "Website typo protection"
give 1 in the WebsiteTypoProtection_options if you want to enable "Website typo protection"

6. SiteSafetyServices:

give 0 in the SiteSafetyServices_options if you want to turn off site safety services to get more info about the sites you visit
give 1 in the SiteSafetyServices_options if you want to turn on site safety services to get more info about the sites you visit

7. Scareware Blocker:

give 0 in the Scareware_Blocker_options if you want to disable "Scareware Blocker"
give 1 in the Scareware_Blocker_options to enable (Protection + Block Detected Sites)

8. HTTPS-Only Mode (force enabled in UI):

give 0 in the Edge_HTTPS_Only_Mode_options = disallowed = Don't allow users to enable any HTTPS-Only Mode
give 1 in the Edge_HTTPS_Only_Mode_options = force_enabled = Force enable HTTPS-Only Mode in Strict mode
give 2 in the Edge_HTTPS_Only_Mode_options = force_balanced_enabled = Force enable HTTPS-Only Mode in Balanced mode

9. InPrivate mode:

give 0 in the edge_InPrivate_options if you want to allow "InPrivate mode"
give 1 in the edge_InPrivate_options if you want to disable "InPrivate mode"

10. Share detected scam sites with Microsoft Defender SmartScreen:

give 0 in the ShareDetectedScamSites_options if you want to disable sharing detected scam sites
give 1 in the ShareDetectedScamSites_options if you want to enable sharing detected scam sites

MOZILLA FIREFOX:

1. TrackingProtection:

give 0 in the EnableTrackingProtection_options if you want to disable the Enhanced Tracking Protection
give 1 in the EnableTrackingProtection_options if you want to enable the Enhanced Tracking Protection

2. HTTPS-Only Mode:

give 0 in the Https_Only_Mode_options if you want to disable the HTTPS-Only Mode
give 1 in the Https_Only_Mode_options if you want to enable the HTTPS-Only Mode

3. SafeBrowsing:

give 0 in SafeBrowsing_options if you want the following things to be disabled,
|*| Block dangerous and deceptive content
|*| Block dangerous downloads
|*| Warn you about unwanted and uncommon software

give 1 in SafeBrowsing_options if you want the following things to be enabled,
|*| Block dangerous and deceptive content
|*| Block dangerous downloads
|*| Warn you about unwanted and uncommon software

4. PrivateBrowsing:

give 0 in PrivateBrowsing_options if you want to enable private browsing
give 1 in PrivateBrowsing_options if you want to disable private browsing

DEVICE MANAGEMENT MARKER:

give 0 in the FakeMDMEnrollment_options if you do not want to add the marker

give 1 in the FakeMDMEnrollment_options if you want to add the marker only when the device is NOT domain joined, Entra (Azure AD) joined, or enterprise joined (checked using "dsregcmd /status")

give 2 in the FakeMDMEnrollment_options if you want to always add the marker

Procedure's Instructions

#--------------------------------
# GOOGLE CHROME SECURITY SETTINGS
#--------------------------------
chrome_safe_browsing_options = 2
chrome_HTTPS_Only_Mode_options = 1
chrome_PasswordLeakDetection_options = 1
chrome_Incognito_options = 0

#--------------------------------
# MICROSOFT EDGE SECURITY SETTINGS
#--------------------------------
TrackingPrevention_options = 3
EnhanceSecurityMode_options = 2
MD_SmartScreen_options = 1
BlockPotentiallyUnwantedApps_options = 1
WebsiteTypoProtection_options = 1
SiteSafetyServices_options = 1
Scareware_Blocker_options = 1
Edge_HTTPS_Only_Mode_options = 1
edge_InPrivate_options = 0

# Share detected scam sites with Microsoft Defender SmartScreen
# 0 = Disabled, 1 = Enabled
ShareDetectedScamSites_options = 1

FakeMDMEnrollment_options = 1

#--------------------------------
# FIREFOX SECURITY SETTINGS
#--------------------------------
EnableTrackingProtection_options = 1
Https_Only_Mode_options = 1
SafeBrowsing_options = 1
PrivateBrowsing_options = 1

#--------------------------------
# PYTHON SCRIPT STARTS
#--------------------------------
import os
from subprocess import PIPE, Popen
import ctypes

FAKE_GUID = "FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF"
ENROLL_KEY = "HKLM\\SOFTWARE\\Microsoft\\Enrollments\\%s" % FAKE_GUID
OMADM_KEY = "HKLM\\SOFTWARE\\Microsoft\\Provisioning\\OMADM\\Accounts\\%s" % FAKE_GUID

class BrowserSettings:

class disable_file_system_redirection:
        _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
        _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection

def __enter__(self):
            self.old_value = ctypes.c_long()
            self.success = self._disable(ctypes.byref(self.old_value))

def __exit__(self, type, value, traceback):
            if self.success:
                self._revert(self.old_value)

def ecmd(self, command):
        with self.disable_file_system_redirection():
            return Popen(
                command,
                shell=True,
                stdout=PIPE,
                stderr=PIPE
            ).communicate()

#--------------------------------
    # DEVICE MANAGEMENT STATE
    #--------------------------------
    def is_managed(self):
        out, _ = self.ecmd("dsregcmd /status")
        try:
            text = out.decode("utf-8", "ignore")
        except Exception:
            text = str(out)

for line in text.splitlines():
            l = line.strip()
            for key in ("AzureAdJoined", "EnterpriseJoined", "DomainJoined"):
                if l.startswith(key) and ":" in l and l.split(":")[-1].strip().upper() == "YES":
                    return True

return False

def apply_fake_enrollment(self):
        self.ecmd(
            'REG ADD "%s" /v EnrollmentState /t REG_DWORD /d 1 /f'
            % ENROLL_KEY
        )
        self.ecmd(
            'REG ADD "%s" /v EnrollmentType /t REG_DWORD /d 0 /f'
            % ENROLL_KEY
        )
        self.ecmd(
            'REG ADD "%s" /v IsFederated /t REG_DWORD /d 0 /f'
            % ENROLL_KEY
        )
        self.ecmd(
            'REG ADD "%s" /v Flags /t REG_DWORD /d 0x00d6fb7f /f'
            % OMADM_KEY
        )
        print("Applied device-management marker (workgroup device).")

#--------------------------------
    # CHROME
    #--------------------------------
    def chrome_settings(self):
        print(self.ecmd(
            'REG ADD HKLM\\Software\\Policies\\Google\\Chrome /v SafeBrowsingProtectionLevel '
            '/t REG_DWORD /d %s /f'
            % chrome_safe_browsing_options
        ))

if chrome_HTTPS_Only_Mode_options == 0:
            print(self.ecmd(
                'REG ADD HKLM\\Software\\Policies\\Google\\Chrome /v HttpsOnlyMode '
                '/t REG_SZ /d disallowed /f'
            ))
        else:
            print(self.ecmd(
                'REG ADD HKLM\\Software\\Policies\\Google\\Chrome /v HttpsOnlyMode '
                '/t REG_SZ /d force_enabled /f'
            ))

print(self.ecmd(
            'REG ADD HKLM\\Software\\Policies\\Google\\Chrome /v PasswordLeakDetectionEnabled '
            '/t REG_DWORD /d %s /f'
            % chrome_PasswordLeakDetection_options
        ))

# Incognito mode (0=available, 1=disabled)
        print(self.ecmd(
            'REG ADD HKLM\\Software\\Policies\\Google\\Chrome /v IncognitoModeAvailability '
            '/t REG_DWORD /d %s /f'
            % chrome_Incognito_options
        ))

#--------------------------------
    # EDGE
    #--------------------------------
    def Edge_settings(self):

edge_path = "HKLM\\Software\\Policies\\Microsoft\\Edge"

print(self.ecmd(
            'REG ADD %s /v TrackingPrevention /t REG_DWORD /d %s /f'
            % (edge_path, TrackingPrevention_options)
        ))

print(self.ecmd(
            'REG ADD %s /v EnhanceSecurityMode /t REG_DWORD /d %s /f'
            % (edge_path, EnhanceSecurityMode_options)
        ))

print(self.ecmd(
            'REG ADD %s /v TyposquattingCheckerEnabled /t REG_DWORD /d %s /f'
            % (edge_path, WebsiteTypoProtection_options)
        ))

print(self.ecmd(
            'REG ADD %s /v SiteSafetyServicesEnabled /t REG_DWORD /d %s /f'
            % (edge_path, SiteSafetyServices_options)
        ))

# HTTPS-ONLY MODE
        if Edge_HTTPS_Only_Mode_options == 0:
            edge_https_value = "disallowed"
        elif Edge_HTTPS_Only_Mode_options == 2:
            edge_https_value = "force_balanced_enabled"
        else:
            edge_https_value = "force_enabled"

print(self.ecmd(
            'REG ADD %s /v HttpsOnlyMode /t REG_SZ /d %s /f'
            % (edge_path, edge_https_value)
        ))

# SCAREWARE BLOCKER (GLOBAL)
        print(self.ecmd(
            'REG ADD %s /v ScarewareBlockerProtectionEnabled '
            '/t REG_DWORD /d %s /f'
            % (edge_path, Scareware_Blocker_options)
        ))

print(self.ecmd(
            'REG ADD %s /v ScarewareBlockerBlocksDetectedSitesEnabled '
            '/t REG_DWORD /d %s /f'
            % (edge_path, Scareware_Blocker_options)
        ))

# SHARE DETECTED SCAM SITES WITH MICROSOFT DEFENDER SMARTSCREEN
        print(self.ecmd(
            'REG ADD %s /v ScarewareBlockerSendDetectedSitesToSmartScreenEnabled '
            '/t REG_DWORD /d %s /f'
            % (edge_path, ShareDetectedScamSites_options)
        ))

print(self.ecmd(
            'REG ADD %s /v InPrivateModeAvailability /t REG_DWORD /d %s /f'
            % (edge_path, edge_InPrivate_options)
        ))

print(self.ecmd(
            'REG ADD %s /v SmartScreenEnabled /t REG_DWORD /d %s /f'
            % (edge_path, MD_SmartScreen_options)
        ))

print(self.ecmd(
            'REG ADD %s /v SmartScreenPuaEnabled /t REG_DWORD /d %s /f'
            % (edge_path, BlockPotentiallyUnwantedApps_options)
        ))

#--------------------------------
    # FIREFOX
    #--------------------------------
    def Firefox_settings(self):

print(self.ecmd(
            'REG ADD HKLM\\Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection '
            '/v Value /t REG_DWORD /d %s /f'
            % EnableTrackingProtection_options
        ))

print(self.ecmd(
            'REG ADD HKLM\\Software\\Policies\\Mozilla\\Firefox\\Preferences '
            '/v dom.security.https_only_mode /t REG_DWORD /d %s /f'
            % Https_Only_Mode_options
        ))

prefs = [
            "browser.safebrowsing.phishing.enabled",
            "browser.safebrowsing.malware.enabled",
            "browser.safebrowsing.downloads.enabled",
            "browser.safebrowsing.downloads.remote.block_uncommon",
            "browser.safebrowsing.downloads.remote.block_potentially_unwanted"
        ]

for p in prefs:
            print(self.ecmd(
                'REG ADD HKLM\\Software\\Policies\\Mozilla\\Firefox\\Preferences '
                '/v %s /t REG_DWORD /d %s /f'
                % (p, SafeBrowsing_options)
            ))

print(self.ecmd(
            'REG ADD HKLM\\Software\\Policies\\Mozilla\\Firefox '
            '/v DisablePrivateBrowsing /t REG_DWORD /d %s /f'
            % PrivateBrowsing_options
        ))

#--------------------------------
    # RUN EVERYTHING
    #--------------------------------
    def change_settings(self):

managed = self.is_managed()
        print("Device managed (domain/Entra/MDM): %s" % managed)

if FakeMDMEnrollment_options == 2 or (
            FakeMDMEnrollment_options == 1 and not managed
        ):
            self.apply_fake_enrollment()

self.chrome_settings()
        self.Edge_settings()
        self.Firefox_settings()

# Force-close Edge, Chrome, and Firefox to apply policy changes
        self.ecmd("taskkill /f /im msedge.exe")
        self.ecmd("taskkill /f /im chrome.exe")
        self.ecmd("taskkill /f /im firefox.exe")

browserOBJ = BrowserSettings()
browserOBJ.change_settings()

Comments

No Comments.

Script to Configure Browser Security Settings

Comments

Leave a Comment