Deactivate Browser Password Managers Using Device Management
This article will direct you on how to disable various web browser's built-in password managers using group policy. These steps will help prevent corporate logins from being saved and synchronized to personal accounts. You may also consider deploying the Bitwarden browser extension to all browsers as part of this same policy.
Open Group Policy Management Editor on your managing Windows server.
In Group Policy Editor, create a new GPO for Edge and provide an appropriate name.
Choose your desired scope.
Right-click the new Group Policy Object → Edit.
On the Group Policy Management Editor, go to User Configuration → Policies → Administrative Templates → Microsoft Edge.
Set the following policies:
Open "Password manager and protection," disable the policy Enable saving passwords to the password manager.
Disable the policy Enable AutoFill for addresses.
Disable the policy Enable AutoFill for payment instruments.
Optionally, you can enable the policy Disable synchronization of data using Microsoft sync services.
Once complete, the GPO settings should show the following:
Ensure the GPO link is enabled.
Open Group Policy Management Editor on your managing Windows server.
In the
ADMX
file, copy the following:policy_templates\windows\admx\chrome.admx
and
TO
policy_templates\windows\admx\google.admxC:\Windows\PolicyDefinitions
In the
ADML
file, copy the following:policy_templates\windows\admx\en-us\chrome.adml
and
policy_templates\windows\admx\en-us\google.adml
TOC:\Windows \PolicyDefinitions\en-us
In Group Policy Editor, create a new GPO for Chrome and provide an appropriate name.
Choose your desired scope.
Right-click the Group Policy Object → Edit.
Go to User Configuration → Policies → Administrative Templates → Google → Google Chrome.
Edit the following settings:
Under "Password Manager," disable the policy Enable saving passwords to the password manager.
Disable the policy Enable AutoFill for Addresses.
Disable the policy Enable AutoFill for credit cards.
Once complete, the GPO settings should show the following:
Ensure the GPO link is enabled.
Open Group Policy Editor on your managing Windows server.
Copy the ADMX file:
FROM the downloaded folderpolicy_templates_v1.##\windows\firefox.admx & mozilla.admx
TOC:\Windows\PolicyDefinitions
Copy the ADML file
FROMpolicy_templates\windows\en-us\firefox.adml & mozilla.adml
TOC:\Windows \PolicyDefinitions\en-us
In Group Policy Editor, create a new GPO for FireFox and provide an appropriate name.
Choose your desired scope.
Right-click the new group policy → Edit.
Open User Configuration → Policies → Administrative Templates → Mozilla → Firefox.
Locate and edit the following policies:
Disable the policy Disable Firefox Accounts.
Disable the policy Offer to save logins.
Disable the policy Offer to save logins (default).
Disable the policy Password Manager.
Once complete, the GPO settings should show the following:
Ensure the GPO link is enabled.
Check that the previous steps worked correctly for your setup:
On a user's computer, Open the command line, and run:
gpupdate /force
.Open Edge, then click the three dots for settings ... → Settings → Passwords.
Ensure "Offer to save passwords" is turned off and managed by the organization.
note
Sign-in automatically is still checked because there is no policy setting to turn this off.
Any logins previously saved in Edge will not be removed and will continue to be displayed to the user, despite autofill being disabled. Be sure to instruct the user to import any saved logins into Bitwarden before deleting them from Edge.
On a user's computer, Open the command line, and run:
gpupdate /force
.Open Chrome and click the profile icon on the top right. See that the user is not signed in.
Open Chrome, then click the three dots ... → Settings → Passwords. See that Offer to save passwords is unchecked and managed by the organization.
On a user's computer, Open the command line, and run:
gpupdate /force
.Open Firefox and select Logins and Passwords from the menu bar.
Ensure that a "Blocked Page" message is displayed.
To disable the Chrome Password Manager via group policy:
Download the Google Chrome .deb or .rpm for Linux.
Download the Chrome Enterprise Bundle.
Unzip the Enterprise Bundle (
GoogleChromeEnterpriseBundle64.zip
orGoogleChromeEnterpriseBundle32.zip
) and open the/Configuration
folder.Make a copy of the
master_preferences.json
(in Chrome 91+,initial_preferences.json
) and rename itmanaged_preferences.json
.To disable Chrome's built-in password manager, add the following to
managed_preferences.json
inside of"policies": { }
:Bash{ "PasswordManagerEnabled": false }
Create the following directories if they do not already exist:
Bashmkdir /etc/opt/chrome/policies mkdir /etc/opt/chrome/policies/managed
Move
managed_preferences.json
into/etc/opt/chrome/policies/managed
.As you will need to deploy these files to users' machines, we recommend making sure only admins can write files in the
/managed
directory.Bashchmod -R 755 /etc/opt/chrome/policies
Additionally, we recommend admins should add the following to files to prevent modifications to the files themselves:
Bashchmod 644 /etc/opt/chrome/policies/managed/managed_preferences.json
Using your preferred software distribution or MDM tool, deploy the following to users' machines:
Google Chrome Browser
/etc/opt/chrome/policies/managed/managed_preferences.json
note
For more help, refer to Google's Chrome Browser Quick Start for Linux guide.
To disable the Firefox Manager via group policy:
Download Firefox for Linux.
Open a terminal and navigate to the directory your download has been saved to. For example:
cd ~/DownloadsExtract to contents of the downloaded file:
Bashtar xjf firefox-*.tar.bz2
The following commands must be executed as root, or preceded by
sudo
.Move the uncompressed Firefox folder to
/opt
:Bashmv firefox /opt
Create a symlink to the Firefox executable:
Bashln -s /opt/firefox /usr/local/bin/firefox
Download a copy of the desktop file:
Bashwget https://raw.githubusercontent.com/mozilla/sumo-kb/main/install-firefox-linux/firefox.desktop -P /usr/local/share/applications
To disable Firefox's built-in password manager, add the following to
policies.json
inside of"policies": {}
:Bash{ "PasswordManagerEnabled": false }
Create the following directory if it does not already exist:
Bashmkdir /opt/firefox/distribution
Modify the directory with the following:
Bashchmod 755 /opt/firefox/distribution
Additionally, we recommend admins should add the following to files to prevent modifications to the files themselves:
Bashchmod 644 /opt/firefox/distribution/policies.json
Using your preferred software distribution or MDM tool, deploy the following to users' machines:
Firefox Browser
/distribution/policies.json
note
For more help, refer to Firefox's policies.json Overview or Policies README on Github.
Download the Google Chrome .dmg or .pkg for macOS.
Download the Chrome Enterprise Bundle.
Unzip the Enterprise Bundle (
GoogleChromeEnterpriseBundle64.zip
orGoogleChromeEnterpriseBundle32.zip
).Open the
/Configuration/com.Google.Chrome.plist
file with any text editor.To disable Chrome's built-in password manager, add the following to
com.Google.Chrome.plist
:Bash<key>PasswordManagerEnabled</key> <false />
Convert the
com.Google.Chrome.plist
file to a configuration profile using a conversion tool of your choice.Deploy the Chrome
.dmg
or.pkg
and the configuration profile using your software distribution or MDM tool to all managed computers.
note
For more help, refer to Google's Chrome Browser Quick Start for Mac guide.
For additional information, see Chrome's documentation for setting up Chrome browser on Mac.
Download and install Firefox for Enterprise for macOS.
Create a
distribution
directory inFirefox.app/Contents/Resources/
.In the created
/distribution
directory, create a new fileorg.mozilla.firefox.plist
.tip
Use the Firefox .plist template and Policy README for reference.
To disable Firefox's built-in password manager, add the following to
org.mozilla.firefox.plist
:Bash<dict> <key>PasswordManagerEnabled</key> <false/> </dict>
Convert the
org.mozilla.firefox.plist
file to a configuration profile using a conversion tool of your choice.Deploy the Firefox
.dmg
and the configuration profile using your software distribution or MDM tool to all managed computers.
For additional information, see Firefox's documentation for MacOS configuration profiles.
Download the Microsoft Edge for macOS .pkg file.
In Terminal, use the following command to create a
.plist
file for Microsoft Edge:Bash/usr/bin/defaults write ~/Desktop/com.microsoft.Edge.plist RestoreOnStartup -int 1
Use the following command to convert the
.plist
from binary to plain text:Bash/usr/bin/plutil -convert xml1 ~/Desktop/com.microsoft.Edge.plist
To disable Edge's built-in password manager, add the following to
com.microsoft.Edge.plist
:Bash<key>PasswordManagerEnabled</key> <false/>
Deploy the Edge
.pkg
and the configuration profile using your software distribution or MDM tool to all managed computers.tip
For Jamf-specific help, refer to Microsoft's documentation on Configuring Microsoft Edge policy settings on macOS with Jamf.
For additional information, see Edge's documentation for configuration profiles.
Suggest changes to this page
How can we improve this page for you?
For technical, billing, and product questions, please contact support