Replace Windows SyncML profile with PowerShell script for Firefox DoH

it-and-security/lib/windows/policies/firefox-doh-check.yml

@@ -0,0 +1,29 @@
+- name: Windows - Firefox DNS over HTTPS (DoH) enabled
+  query: |
+    SELECT 1 WHERE EXISTS (
+      SELECT 1 FROM file
+      WHERE path = 'C:\Program Files\Mozilla Firefox\distribution\policies.json'
+      OR path = 'C:\Program Files (x86)\Mozilla Firefox\distribution\policies.json'
+    )
+    AND EXISTS (
+      SELECT 1 FROM file_lines
+      WHERE (path = 'C:\Program Files\Mozilla Firefox\distribution\policies.json'
+        OR path = 'C:\Program Files (x86)\Mozilla Firefox\distribution\policies.json')
+      AND line LIKE '%"Enabled": true%'
+    )
+    AND EXISTS (
+      SELECT 1 FROM file_lines
+      WHERE (path = 'C:\Program Files\Mozilla Firefox\distribution\policies.json'
+        OR path = 'C:\Program Files (x86)\Mozilla Firefox\distribution\policies.json')
+      AND line LIKE '%"Fallback": true%'
+    )
+    AND EXISTS (
+      SELECT 1 FROM file_lines
+      WHERE (path = 'C:\Program Files\Mozilla Firefox\distribution\policies.json'
+        OR path = 'C:\Program Files (x86)\Mozilla Firefox\distribution\policies.json')
+      AND line LIKE '%"Locked": true%'
+    );
+  critical: false
+  description: "Checks that the Firefox enterprise policies.json file is deployed with DNS over HTTPS (DoH) enabled, fallback allowed, and the setting locked. Failing this policy means the policies.json file is missing or does not contain the correct DoH configuration."
+  resolution: "Run the deploy-firefox-doh-policy script from Fleet to create or update the policies.json file in the Firefox installation directory. If Firefox is not installed, this policy can be ignored."
+  platform: windows

it-and-security/lib/windows/scripts/deploy-firefox-doh-policy.ps1

@@ -0,0 +1,40 @@
+# Deploy Firefox DNS over HTTPS (DoH) policy via policies.json
+# This script creates/overwrites the Firefox enterprise policies.json file
+# to enforce DNS over HTTPS with fallback enabled.
+# Idempotent: safe to run multiple times.
+
+$policiesContent = @'
+{
+  "policies": {
+    "DNSOverHTTPS": {
+      "Enabled": true,
+      "Fallback": true,
+      "Locked": true
+    }
+  }
+}
+'@
+
+$firefoxPaths = @(
+    "$env:ProgramFiles\Mozilla Firefox",
+    "${env:ProgramFiles(x86)}\Mozilla Firefox"
+)
+
+$deployed = $false
+
+foreach ($firefoxPath in $firefoxPaths) {
+    if (Test-Path -Path $firefoxPath) {
+        $distributionPath = Join-Path -Path $firefoxPath -ChildPath "distribution"
+        if (-not (Test-Path -Path $distributionPath)) {
+            New-Item -Path $distributionPath -ItemType Directory -Force | Out-Null
+        }
+        $policiesFile = Join-Path -Path $distributionPath -ChildPath "policies.json"
+        Set-Content -Path $policiesFile -Value $policiesContent -Encoding UTF8 -Force
+        Write-Output "Deployed policies.json to $policiesFile"
+        $deployed = $true
+    }
+}
+
+if (-not $deployed) {
+    Write-Output "No Firefox installation found. Skipping policies.json deployment."
+}

it-and-security/teams/workstations.yml

@@ -104,7 +104,6 @@ controls:
       - path: ../lib/windows/configuration-profiles/Disable OneDrive.xml
       - path: ../lib/windows/configuration-profiles/Disable Guest account.xml
       - path: ../lib/windows/configuration-profiles/Windows Defender compliance settings.xml
-      - path: ../lib/windows/configuration-profiles/Firefox DNS over HTTPS.xml
   windows_updates:
     deadline_days: 7
     grace_period_days: 2
@@ -121,6 +120,7 @@ controls:
     - path: ../lib/windows/scripts/install-bitdefender.ps1
     - path: ../lib/windows/scripts/enable-ms-defender.ps1
     - path: ../lib/windows/scripts/create-admin-user.ps1
+    - path: ../lib/windows/scripts/deploy-firefox-doh-policy.ps1
     - path: ../lib/linux/scripts/uninstall-fleetd-linux.sh
     - path: ../lib/macos/scripts/uninstall-santa-extension.sh
     - path: ../lib/macos/scripts/install-macos-compatibility-extension.sh
@@ -152,6 +152,7 @@ policies:
   - path: ../lib/windows/policies/update-1password.yml
   - path: ../lib/windows/policies/update-claude.yml
   - path: ../lib/windows/policies/windows-defender-compliance-check.yml
+  - path: ../lib/windows/policies/firefox-doh-check.yml
   # Linux policies
   - path: ../lib/linux/policies/disk-encryption-check.yml
   - path: ../lib/linux/policies/disk-space-check.yml