Cheffile lockfile must contain the new sysadmins too.
Bash-shell for sysadmins and use sysadmins group.

Give users a bash-shell by default: else they have no shell at all.
Actually run the sysadmins cookbook on base