Microsoft Edge for Business ADMX template issue - ForceSync

Question

question

Fulforce asked Aug 20, '21 YuZhou-MSFT commented Aug 24, '21

Microsoft Edge for Business ADMX template issue - ForceSync

Hi Microsoft,

The latest ADMX templates for Microsoft Edge for Business have an issue. Particularly the setting "ForceSync" that has the display name of "Force synchronization of browser data and do not show the sync consent prompt".

When checking the msedge.ADMX file in Notepad++ I can see that this setting should have two options available to configure. 0=Disabled and 1=Enabled. Extract from the file below:

 <policy class="Both" displayName="$(string.ForceSync)" explainText="$(string.ForceSync_Explain)" key="Software\Policies\Microsoft\Edge" name="ForceSync" presentation="$(presentation.ForceSync)" valueName="ForceSync"> 
   <parentCategory ref="microsoft_edge"/> 
   <supportedOn ref="SUPPORTED_WIN7_V86"/> 
   <enabledValue> 
     <decimal value="1"/> 
   </enabledValue> 
   <disabledValue> 
     <decimal value="0"/>

However, when you come to configure this policy in Group Policy Management Editor on a DC after uploading the latest ADMX templates, this pane is empty. The two options I'd expect to appear as radio buttons or a drop down menu. Neither of these appear so the policy is not actually configurable. Therefore, by default it disables this setting.

Screenshot below:

I've waited for 2-3 ADMX template releases now hoping it'll get noticed and be fixed, but it has not. So I'd like to raise it here. Can this please be passed to the relevant team and resolved in the next ADMX template release for Edge? We would like to utilise this in our organisation.

The setting should be able to be Enabled and then configure 0 or 1 as to whether you'd like to enforce this setting or not.

Thanks.

Kind regards,

Joe

windows-server windows-group-policy ms-edge

image.png (138.2 KiB)

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2021-08-20T17:00:39.743Z

Firedog answered Aug 20, '21 YuZhou-MSFT commented Aug 24, '21

The setting should be able to be Enabled and then configure 0 or 1 as to whether you'd like to enforce this setting or not.

Apparently not. Not all GPOs are configured in the same way. It looks as if this one is 'self-configuring' - if the policy is enabled, the reg key value ForceSync acquires data 1, but if it's disabled, the data will be 0:

image.png (22.7 KiB)

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Fulforce · Aug 20, 2021 at 05:06 PM

hat's interesting, not sure why I hadn't looked at it that way. I was used to others having the options. I had enabled the setting and it didn't enable it for me last I tried. It was definitely the winning GPO as I checked gpresult, in fact we don't set it with the usual GPO for everyone anyway.

I'll test this tomorrow when I'm logged back on my work laptop and check the result. Previously I had Sync enabled in my Edge, then applied the policy to me with the status Enabled and it actually disabled the setting. It remains set that way still now.

I'll make sure the latest ADMX are loaded up on the DC and try it out. Thanks for checking this, I appreciate your help and time.

0 ·

YuZhou-MSFT Fulforce · Aug 24, 2021 at 02:26 AM

Hi @Fulforce

I agree with Firedog's answer. This group policy doesn't have options. If you don't configure this policy, users will be able to turn sync on or off. If you enable this policy, users will not be able to turn sync off.

Besides, from this doc:

For this policy to work as intended, BrowserSignin policy must not be configured, or must be set to enabled. If BrowserSignin is set to disabled, then ForceSync will not take affect.

SyncDisabled must not be configured or must be set to False. If this is set to True, ForceSync will not take affect.

You need to pay attention to see if you have configured the above policies which makes ForceSync not working.

Best Regards,
Yu Zhou

0 ·

question