Disable browser default password managers - Windows GPO

This topic detail the steps to disable the default password manager in the Edge, Firefox and Chrome browsers, as well as steps to confirm the password manager is disabled.

Disabling the browser default password manager

Edge

  1. Open Group Policy Management Editor on your managing Windows server.
  2. Download the most suitable Edge Policy Template from Microsoft.
  3. In the Group Policy Editor, create a new GPO for Edge and provide an appropriate name.
  4. Select the required scope.
  5. Right-click your new Group Policy Object and select Edit.
  6. in the Group Policy Management Editor, navigate to User Configuration > Policies > Administrative Templates > Microsoft Edge.
  7. Configure the following:
    1. Open Password manager and protection, disable Enable saving passwords to the password manager.
    2. Disable Enable AutoFill for addresses.
    3. Disable Enable AutoFill for payment instruments.
    4. (Optional) Enable Disable synchronization of data using Microsoft sync services.

  8. Ensure the GPO link is enabled.

Chrome

  1. Open Group Policy Management Editor on your managing Windows server.
  2. Download the Chrome Administrative Templates from Google.
  3. From the policy_templates\windows\admx\ directory, copy the following files to C:\Windows\PolicyDefinitions\.
    • chrome.admx
    • google.admx
  4. From the policy_templates\windows\admx\<your language> directory, copy the following files to C:\Windows \PolicyDefinitions\<your-language>\.
    • chrome.adml
    • google.adml
  5. In the Group Policy Editor, create a new GPO for Chrome and provide an appropriate name.
  6. Choose your desired scope.
  7. Right-click the Group Policy Object and select Edit.
  8. Go to User Configuration > Policies > Administrative Templates > Google > Google Chrome.
  9. Edit the following settings:
    • Under Password Manager, disable the policy Enable saving passwords to the password manager.
    • Disable the policy Enable AutoFill for Addresses.
    • Disable the policy Enable AutoFill for credit cards.

    Once complete, the GPO settings should show the following:

  10. Ensure the GPO link is enabled.

Firefox

  1. Open the Group Policy Editor on your managing Windows server.
  2. Download the latest Firefox Policy Templates .zip file from Mozilla.
  3. From policy_templates_v1.##\windows\ copy the ADMX files firefox.admx and mozilla.admx to C:\Windows\PolicyDefinitions\
  4. From policy_templates\windows\en-us\ copy the ADML files from firefox.adml & mozilla.adml to C:\Windows \PolicyDefinitions\en-us.
  5. In Group Policy Editor, create a new GPO for Firefox and provide an appropriate name.
  6. Choose your desired scope.
  7. Right-click your new group policy > Edit.
  8. Open User Configuration > Policies > Administrative Templates > Mozilla > Firefox.
  9. Locate and edit the following policies:
    • Disable the policy Disable Firefox Accounts.
    • Disable the policy Offer to save logins.
    • Disable the policy Offer to save logins (default).
    • Disable the policy Password Manager.

    Once complete, the GPO settings should show the following:

  10. Ensure the GPO link is enabled.

To confirm the default password manager is disabled

Edge

Any logins previously saved in Edge will not be removed and will continue to be displayed to the user, despite autofill being disabled. Users should import or otherwise record any saved logins into Passportal before deleting them from Edge.

  1. On a user's computer, open the command line, and run:

    2. gpupdate /force

  2. Open Edge, navigate to Settings > Passwords.
  3. Ensure Offer to save passwords is turned off and shows as managed by the organization.

Sign-in automatically is still checked because there is no policy setting to turn this off.

Chrome

  1. On a user's computer, Open the command line, and run:

    2. gpupdate /force

  2. Open Chrome and click the profile icon on the top right. Confirm that the user is not signed in.
  3. Open the Chrome menu (the three dots button) > Settings > Passwords. Confirm that Offer to save passwords is unchecked and managed by the organization.

Firefox

  1. On a user's computer, Open the command line, and run:

    2. gpupdate /force

  2. Open Firefox and select Logins and Passwords from the menu bar.
  3. Ensure that the Blocked Page advisory is displayed.