Core Restrictive Policies for Microsoft Edge

These policies are intended to lock‑down Edge so that users cannot bypass the corporate browser choice (Firefox) or take advantage of Edge‑specific features such as the start‑up boost, sidebar search or automatic session restore.

You can enforce them either via Group Policy (gpedit.msc / GPMC) or directly in the Registry under

HKLM\SOFTWARE\Policies\Microsoft\Edge

Tip: If you manage many PCs through Active Directory, create a Group Policy Object (GPO) and link it to the appropriate OU. The GPO will automatically write the required registry values on each machine.

1. Prevent users from changing the default browser

How to apply

• Group Policy:

1. Open gpedit.msc → Computer Configuration → Administrative Templates → Microsoft Edge → Default browser
2. Enable “Allow users to set Microsoft Edge as default browser” and set it to Disabled (this writes DefaultBrowserSettingEnabled = 0).
3. Enable “Default browser setting” and choose “Policy‑managed” (writes DefaultBrowserSetting = 1).

  [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge]
  "DefaultBrowserSettingEnabled"=dword:00000000
  "DefaultBrowserSetting"=dword:00000001

• Registry:

2. Block Edge’s built‑in search integration

Implementation

  "BrowserDefaultSearchProviderEnabled"=dword:00000000

• Group Policy: Computer Configuration → Administrative Templates → Microsoft Edge → Search → “Allow Microsoft Edge to set a default search provider” → Disabled.
• Registry:

3. Disable the “startup boost” (pre‑launch) feature

Implementation

  "StartupBoostEnabled"=dword:00000000

• Group Policy: Computer Configuration → Administrative Templates → Microsoft Edge → Startup, home page and new tab page → “Enable startup boost” → Disabled.
• Registry:

4. Prevent Edge from auto‑starting or restoring sessions

Implementation

• Group Policy:

1. Computer Configuration → Administrative Templates → Microsoft Edge → Startup, home page and new tab page → “Configure pre-launch on login page load” → Disabled.
2. “Configure what happens on startup” → Open the new tab page (this writes RestoreOnStartup = 0).

  "PrelaunchOnLoginPageLoad"=dword:00000000
  "RestoreOnStartup"=dword:00000000

• Registry:

5. Extra Edge‑specific lock‑downs (useful when the above are not enough)

Add these keys under the same HKLM\SOFTWARE\Policies\Microsoft\Edge path.

6. Apply the changes

1. Force a policy refresh on the client machine:

   gpupdate /force

1. Log off and log back on, or restart the PC to ensure any background Edge processes are terminated.

1. Verify the policies are active:

Open Edge and navigate to edge://policy/ – you will see a table listing every policy that Edge recognises, its source (Registry or Group Policy) and the current value.

Firefox Enforcement – Step‑by‑Step

Once Edge is locked down, the next goal is to make Firefox the default browser and keep it that way.

1. Deploy the Firefox Enterprise MSI

2. Lock the default‑browser choice

Apply the Core Restrictive Policies listed earlier (DefaultBrowserSettingEnabled = 0, DefaultBrowserSetting = 1). Because the default is now set to Firefox in Windows Settings, Edge will be prevented from overriding it.

3. Block Edge‑specific UI that could tempt users

Add these entries the same way as the other Edge policies.

4. (Optional) Prevent Edge from being launched at all

If you want an extra safety net, you can deny execution of msedge.exe via AppLocker or Software Restriction Policies:

# AppLocker (Windows 10/11 Enterprise)
Path rule: C:\Program Files (x86)\Microsoft\Edge\msedge.exe → Deny
Path rule: C:\Program Files\Microsoft\Edge\msedge.exe → Deny

Caution: Do this only after you have confirmed Firefox works perfectly for all users, otherwise you may inadvertently block a legitimate web‑access method.

5. Test the whole chain

1. Log on to a test workstation (not a production machine).
2. Run edge://policy/ – verify all the Edge policies are listed and set to 0 or 1 as intended.
3. Open Settings → Apps → Default apps – ensure Firefox is shown as the default for HTTP, HTTPS, .HTML, .HTM, etc.
4. Attempt to change the default to Edge – the UI should be greyed out or display an error, confirming the policies are effective.
5. Open a few URLs (e.g. http://www.bbc.co.uk) – they should launch in Firefox automatically.

Common Issues & Troubleshooting

Quick Reference – All Registry Entries in One Block

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge]
"DefaultBrowserSettingEnabled"=dword:00000000
"DefaultBrowserSetting"=dword:00000001
"BrowserDefaultSearchProviderEnabled"=dword:00000000
"StartupBoostEnabled"=dword:00000000
"PrelaunchOnLoginPageLoad"=dword:00000000
"RestoreOnStartup"=dword:00000000
"SideBySideSearchEnabled"=dword:00000000
"ShowHomeButton"=dword:00000000

Copy the above into a .reg file, double‑click on a test machine, accept the prompt, then run gpupdate /force.

Bottom line

1. Deploy Firefox (Enterprise MSI) and set it as the system default once.
2. Lock the default‑browser setting with DefaultBrowserSettingEnabled = 0 and DefaultBrowserSetting = 1.
3. Apply the Edge‑restriction policies (search, startup boost, pre‑launch, restore, sidebar, home button).
4. Force a policy refresh, verify at edge://policy/, and test the user experience.

Following these steps will give you a tightly controlled browser environment where Edge cannot be used or altered, and Firefox remains the only authorised web browser on the machine.

If you need further assistance—e.g., creating a GPO template, scripting the registry import, or integrating the settings into SCCM/Intune—feel free to get in touch. Happy configuring!