Restrict Browser Password Saving

[wmayhone]

Simply put we are looking for a way to disable the ability to save passwords in the major three browsers (Safari, Firefox, Chrome). Through all of our searching we're unable to find which preference files, or settings we can push out via Jamf to disable this. It seems the modern versions of the browsers make this complicated. Ideally if it was a package we could deploy via a policy that would be perfect, especially if the users themselves couldn't go and manually enabled this option later. Also if it was something we had to run say, once per day, we are probably open to doing that as well. Just seeing if anyone has any ideas or methods they are using.

[ShaunRMiller83]

The way I've handled this in the past comes in a few diffrent forms.

For Safari:
On an admin system setup the Safari Prefs exactly how I wanted them to be. Then copy the com.Apple.Safari plist from (User Library Prefs) to my desktop. Open it in your favorite text editor and remove any settings you may not want or need. Lastly I would import that into a JAMF Config Profile as a custom setting. (Note: I believe in Mojave the Safari settings are now stored in a db file so this may only work in OSs below 10.14.x)

For Firefox:
Use the CCK2 extension, package up the resulting files using composer and deploy the package to a smart group for systems with Firefox installed

For Google Chrome:
Use Google Chrome Managed Prefrences which in turn would also become a a JAMF config profile.

[gabester]

This post was mentioned in another question where there was a question about more detail, namely https://community.jamf.com/t5/jamf-pro/disable-chrome-auto-fill-and-saving-for-passwords-and-credit/... referencing  

---

@ShaunRMiller83 wrote:

Use Google Chrome Managed Prefrences which in turn would also become a a JAMF config profile.

---

To which I'll add from the other page, do something like :

Find the desired behavior / value for https://chromeenterprise.google/policies/#PasswordManagerEnabled which in this case is:

• false = Disable saving passwords using the password manager

Then you need an XML file to upload into JAMF, something that looks like this, which you'll upload to your Jamf Pro configuration profile's Applications & Custom Settings payload under the preference domain com.google.Chrome: 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>PasswordManagerEnabled</key>
    <false />
  </dict>
</plist>

[wmayhone]

Thanks a ton for the info @ShaunRMiller83 Chrome is now going to be locked down and we're working on the other two.

[mberger]

Whats the exact location of the " com.Apple.Safari " plist?

[Nate1981]

You can disable Safari autofill in configuration profiles. Under restrictions there is an Allow Safari AutoFill checkbox.

[jcarr]

Please excuse the rant, but I'm curious as to the reasoning behind this? This just sounds like bad news to me. Preventing users from using the built-in password management features will likely force users into bad habits (e.g. using simple, easy to guess password and re-using passwords at multiple sites). Teaching and enforcing good password habits would seem to be a better approach. Might this be a technical solution to a non-technical problem?

Just my $0.02.

[royaltouchez]

Thanks @Nate1981 if this works; I will test it out.

@jcarr .... I would agree in that if you were not providing an alternative to good habits with passwords this would be a bad idea BUT if you were building an enterprise password management solution this is a much needed step to assist in enforcing new habits.