[Unit]
Description=Refresh ADSys GPO for machine on boot
# ADsys must be running before we permit user sessions, once sssd is ready
Before=systemd-user-sessions.service nss-user-lookup.target
After=sssd.service
Wants=sssd.service
# Only start machine GPO download on boot (blocking) if we have AD configured
ConditionPathExists=/etc/sssd/sssd.conf

[Service]
Type=oneshot
# Only machine krb5 ticket is available at boot, so this will update the machine only.
ExecStart=/sbin/adsysctl update --all
# Restart trying to refresh policy on boot if failed (no cache and offline).
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target
