dtenenba and I worked through this offline. I’m posting some findings for internet posterity:
The impersonation succeeds if the user running the chef run has the Replace a process level token permission. In the case of a Test-Kitchen run via vagrant, that will likely be the vagrant user unless you have created a separate account.
You can have chef apply the permission with this in a ruby_block:
Chef::ReservedNames::Win32::Security.add_account_right('vagrant', 'SeAssignPrimaryTokenPrivilege')
But here’s a kicker: If you set that for the user currently loged in, it won’t take effect until that user logs out and back in. Therefore setting that right just before impersonation will fail. You would need to set the right and then perform the impersonation in a separate chef run.
Ideally, you would give the user this right as part of the base box creation so that its already set after a vagrant up.
Alternatively, but very hacky, you could check to see if the right exists using:
Chef::ReservedNames::Win32::Security.get_account_right('vagrant').include?('SeAssignPrimaryTokenPrivilege')
If its missing set it and skip the impersonation leaving that for the next converge.
Matt