A validation update to the windows_user_privilege resource I believe will assist with issue #10420

2 files changed, 6 insertions, 5 deletions

diff --git a/kitchen-tests/cookbooks/end_to_end/recipes/windows.rb b/kitchen-tests/cookbooks/end_to_end/recipes/windows.rb
index 33fc16e38a..6ae873d166 100644
--- a/kitchen-tests/cookbooks/end_to_end/recipes/windows.rb
+++ b/kitchen-tests/cookbooks/end_to_end/recipes/windows.rb
@@ -38,6 +38,11 @@ windows_firewall_profile "Domain" do
   action :enable
 end
 
+windows_user_privilege "BUILTIN\\Administrators" do
+  privilege %w(SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege)
+  action :add
+end
+
 windows_firewall_profile "Public" do
   action :disable
 end
diff --git a/lib/chef/resource/windows_user_privilege.rb b/lib/chef/resource/windows_user_privilege.rb
index a39250afc1..cfe169b852 100644
--- a/lib/chef/resource/windows_user_privilege.rb
+++ b/lib/chef/resource/windows_user_privilege.rb
@@ -136,11 +136,7 @@ class Chef
         description: "Privilege to set for users.",
         required: true,
         coerce: proc { |v| v.is_a?(String) ? Array[v] : v },
-        callbacks: {
-           "Option privilege must include any of the: #{privilege_opts}" => lambda { |v|
-             (privilege_opts & v).size == v.size
-           },
-         }
+        callbacks: { "Option privilege must include any of the: #{privilege_opts}" => proc { |v| (Array(v) - privilege_opts).empty? } }
 
       load_current_value do |new_resource|
         if new_resource.principal && (new_resource.action.include?(:add) || new_resource.action.include?(:remove))