Way for administrators to disable users from installing Firefox extensions

The plugins' settings are now integrated partially in about:config as of Firefox 22, and fully in 23+. The key names are plugin.state.* where * denotes the internal naming scheme used by Firefox for the discovered plugins. The values (integer) are 0 for disabled (Never Activate in Firefox Tools (Alt + T) > Add-ons > Plugins), 1 for click-to-play (Ask to Activate), and 2 for enabled (Always Activate). Firefox 22 has 0 and 2, and 23+ includes all the three states. The state Ask to Activate (1) is triggered after toggling plugins.click_to_play to true in about:config.

One way to get the correct names used by Firefox is from a reference/IT PC. Toggle the default states of all the discovered plugins (Firefox Tools (Alt + T) > Add-ons > Plugins) once, to reveal the corresponding plugin.state.* keys in about:config.

Using the lock (policy) file, defaultPref() or pref() can be used to set an initial preference i.e. nonmandatory - users may later change the initially set state of the plugin -, while lockPref() can be used to set a policy i.e mandatory - users cannot change the state.

e.g. defaultPref("plugin.state.flash", 0); to set an initial disabled state for the Flash plugin which users may change, or lockPref("plugin.state.flash", 0); to lock the state.

To also include Ask to Activate (1):

defaultPref("plugins.click_to_play", true); OR lockPref("plugins.click_to_play", true);
defaultPref("plugin.state.flash", 1);

about:config Entries, Config Descriptions addon

A few thoughts come to mind, which may be of varying utility.

1. if you open about:config in the browser bar, there's a preference called browser.fullscreen.autohide which is set to true by default. If you toggle it to false, the tabs and address/url bar won't disappear anymore. You can change that option globally with a script or GPO (a GPO with no script would require one of the custom FF adm templates out there) to eliminate some of the user panic caused by full screen mode. Menu bar will still disappear, but users who think a webpage made their computer disappear probably don't use that much anyway.

2. The Firefox keyconfig add-on. You could use it to change the full screen to Ctrl-Alt-Shift-F or disable it all together. Honestly, I haven't done an enterprise Firefox roll out in forever, so I'm not sure how easy, difficult, or completely impossible it is to modify a setting in an add-on/extension via script or GPO.

3. The function called to go into fullscreen is BrowserFullScreen();, which seems like it could be useful if you wanted to punch something up to intercept or block that function call.

4. User education and/or abuse. True wisdom comes only through suffering. Make your users wise beyond their years. I'm rather partial to the below picture, but your users may be less intimidated by you, or not have a phobia about burning to death. YMMV.