As far as I know, updating an ESR version can be done by installing any other ESR version over it if that’s newer. You could see it as "ESR has a max version and platform checker, but is similar to any other version, so will either install as new or update an existing version." Even better, if no steps are taken to prevent it (and when not using BigFish), it should be updating by itself as soon as 52.3 is available.

Would you be able to try updating one install to see what happens when launching the 52.3 installer manually, either with or without BigFish?

Thanks for your answer! That is exactly what I had hoped it would do. I will look for an older version of the ESR installer to test on my machine. We only just recently allowed Firefox to our Enterprise so only about 50 or so people have installed it and none within our Vulns. Mgmt team (makes doing CAC enabled logons difficult so we just keep using IE)

See also:

• https://wiki.mozilla.org/Software_Update:Manually_Installing_a_MAR_file

Ok, so this works fine in BigFix, however when I tried a manual push through psexec, I find that it is blocked by HBSS due to it unpacking into a temp directory: "Blocked by access protection rule. Access to object C:\USERS\RHYS.FERRIS.W.MIT\APPDATA\LOCAL\TEMP\7ZSDB9C.TMP\SETUP.EXE was blocked by rule Common Standard Protection:Prevent common programs from running files from the Temp folder."

Any Ideas?

Not entirely my area of expertise, but that sounds like a McAfee security feature. Can you add an exception as given e.g. here?