# Execute resource on windows as alternate user

**URL:** <https://discourse.chef.io/t/execute-resource-on-windows-as-alternate-user/8029>\
**Category:** Chef Infra (archive)\
**Created:** [March 21, 2016, 6:34pm UTC](https://discourse.chef.io/t/execute-resource-on-windows-as-alternate-user/8029 "2016-03-21T18:34:18Z")\
**Posts on this page:** 1\
**Showing post:** 13

<div class="post-metadata">

**Author:** ![Matt\_Wrock](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/matt_wrock/32/3394_2.png) [@Matt\_Wrock](https://discourse.chef.io/u/Matt_Wrock)\
**Post date:** [March 23, 2016, 12:07am UTC](https://discourse.chef.io/t/execute-resource-on-windows-as-alternate-user/8029/13 "2016-03-23T00:07:32Z")

</div>

dtenenba and I worked through this offline. I’m posting some findings for internet posterity:

The impersonation succeeds if the user running the chef run has the `Replace a process level token` permission. In the case of a Test-Kitchen run via vagrant, that will likely be the `vagrant` user unless you have created a separate account.

You can have chef apply the permission with this in a `ruby_block`:

```auto
Chef::ReservedNames::Win32::Security.add_account_right('vagrant', 'SeAssignPrimaryTokenPrivilege')

```

But here’s a kicker: If you set that for the user currently loged in, it won’t take effect until that user logs out and back in. Therefore setting that right just before impersonation will fail. You would need to set the right and then perform the impersonation in a separate chef run.

Ideally, you would give the user this right as part of the base box creation so that its already set after a `vagrant up`.

Alternatively, but very hacky, you could check to see if the right exists using:

```auto
Chef::ReservedNames::Win32::Security.get_account_right('vagrant').include?('SeAssignPrimaryTokenPrivilege')

```

If its missing set it and skip the impersonation leaving that for the next converge.

Matt

---

_[View the full topic](https://discourse.chef.io/t/execute-resource-on-windows-as-alternate-user/8029)._