gistfile1.txt

def remove_login_rights(user) 
	cookbook_file "ntrights.exe" do
		source "ntrights.exe"
		path "/windows/temp"
		mode '0644'
			action :create_if_missing
			notifies :run, 'execute[remove-right]', :immediately
	end

	execute "remove-right" do
		#cwd "C:\\windows\\temp"
		command "ntrights -u #{user} +r SeDenyInteractiveLogonRight"
		action :nothing

	end

How would you feel about:

def remove_login_rights(user)
  cookbook_file "C:\Windows\Temp\ntrights.exe" do
    source "ntrights.exe"
    mode '0644'
    action :create_if_missing
    notifies :run, 'execute[remove-right]', :immediately
  end

  execute "remove-right" do
    # Avoid assuming working directory?
    command "C:\Windows\Temp\ntrights.exe -u #{user} +r SeDenyInteractiveLogonRight"
    action :nothing
  end
end

The wiring of the execute[remove-right] to the cookbook_file will mean that the user will not have their login right removed if ntrights.exe exists. Once you drop the file on the system, you'll only ever be able to remove that right on one user as written above.

@trekr5 Will ntrights.exe return an error if you attempt to revoke a right that a user does not have? If not, if it is safe to attempt a revoke even if the user does not have the right, I suggest removing the notifies in the cookbook_file and changing remove-right to action :run.

def remove_login_rights(user)
  cookbook_file "C:\Windows\Temp\ntrights.exe" do
    source "ntrights.exe"
    mode '0644'
    action :create_if_missing
  end

  execute "remove-right" do
    # Avoid assuming working directory?
    command "C:\Windows\Temp\ntrights.exe -u #{user} +r SeDenyInteractiveLogonRight"
    action :run
  end
end

You could probably even omit the action :create_if_missing from cookbook_file. The default action is :create which should handle your use case as I understand it.

So ...

def remove_login_rights(user)
  cookbook_file "C:\Windows\Temp\ntrights.exe" do
    source "ntrights.exe"
    mode '0644'
  end

  execute "remove-right" do
    # Avoid assuming working directory?
    command "C:\Windows\Temp\ntrights.exe -u #{user} +r SeDenyInteractiveLogonRight"
    action :run
  end
end

def remove_login_rights(user)
cookbook_file "C:\Windows\Temp\ntrights.exe" do
source "ntrights.exe"
#path "C:\windows\temp"
mode '0644'
#verify File.exist?('ntrights.exe')
action :create_if_missing
notifies :run, 'execute[remove-right]', :immediately
end

execute "remove-right" do
    #cwd "C:\\windows\\temp"
    command "C:\\Windows\\Temp\\ntrights.exe -u #{user} +r SeDenyInteractiveLogonRight"
    action :nothing

end

end

Something to keep in mind with a cookbook_file resource: the code under the hood in the cookbook_file provider handles the whole file already exists question.

would it use powershell under the hood because the vagrant box i'm using is a windows 2012 server

users_manage "sudo" do
data_bag "aws-admin-users"
group_id node.default['sudo_group_id']
action [:remove, :create]
end

users_manage "sudo" do
data_bag "aws-admin-users"
group_id node.default['sudo_group_id']
action [:remove, :create]
end