All extensions disabled due to expiration of intermediate signing cert

So let's say I'm the IT department in my company. I've already got my root cert on every employee's PC(including Firefox because they can't browse otherwise). Can I act like the Normandy endpoint and let's say remotely disable the ability to install any extension including those pesky VPN ones and also do a lot of other such things I would like, you get my drift? Am I right? Am I right?

Please tell me I'm wrong.

You are wondering if an IT admin can admin machines in its network? Yes, an IT admin can admin machines in it's network.