gistfile1.txt

def remove_login_rights(user) 
	cookbook_file "ntrights.exe" do
		source "ntrights.exe"
		path "/windows/temp"
		mode '0644'
			action :create_if_missing
			notifies :run, 'execute[remove-right]', :immediately
	end

	execute "remove-right" do
		#cwd "C:\\windows\\temp"
		command "ntrights -u #{user} +r SeDenyInteractiveLogonRight"
		action :nothing

	end

You could probably even omit the action :create_if_missing from cookbook_file. The default action is :create which should handle your use case as I understand it.

So ...

def remove_login_rights(user)
  cookbook_file "C:\Windows\Temp\ntrights.exe" do
    source "ntrights.exe"
    mode '0644'
  end

  execute "remove-right" do
    # Avoid assuming working directory?
    command "C:\Windows\Temp\ntrights.exe -u #{user} +r SeDenyInteractiveLogonRight"
    action :run
  end
end

def remove_login_rights(user)
cookbook_file "C:\Windows\Temp\ntrights.exe" do
source "ntrights.exe"
#path "C:\windows\temp"
mode '0644'
#verify File.exist?('ntrights.exe')
action :create_if_missing
notifies :run, 'execute[remove-right]', :immediately
end

execute "remove-right" do
    #cwd "C:\\windows\\temp"
    command "C:\\Windows\\Temp\\ntrights.exe -u #{user} +r SeDenyInteractiveLogonRight"
    action :nothing

end

end

Something to keep in mind with a cookbook_file resource: the code under the hood in the cookbook_file provider handles the whole file already exists question.

would it use powershell under the hood because the vagrant box i'm using is a windows 2012 server

users_manage "sudo" do
data_bag "aws-admin-users"
group_id node.default['sudo_group_id']
action [:remove, :create]
end

users_manage "sudo" do
data_bag "aws-admin-users"
group_id node.default['sudo_group_id']
action [:remove, :create]
end