diff --git a/monkey/tests/infection_monkey/utils/linux/test_users.py b/monkey/tests/infection_monkey/utils/linux/test_users.py
index 67a3a35d4..8b0408c0a 100644
--- a/monkey/tests/infection_monkey/utils/linux/test_users.py
+++ b/monkey/tests/infection_monkey/utils/linux/test_users.py
@@ -9,7 +9,7 @@ TEST_USER = "test_user"
 
 @pytest.fixture
 def subprocess_check_output_spy(monkeypatch):
-    def mock_check_output(command, stderr, shell):
+    def mock_check_output(command, stderr):
         mock_check_output.command = command
 
     mock_check_output.command = ""
@@ -21,11 +21,11 @@ def subprocess_check_output_spy(monkeypatch):
 
 def test_new_user_expires(subprocess_check_output_spy):
     with (AutoNewLinuxUser(TEST_USER, "password")):
-        assert "--expiredate" in subprocess_check_output_spy.command
-        assert "--inactive 0" in subprocess_check_output_spy.command
+        assert "--expiredate" in " ".join(subprocess_check_output_spy.command)
+        assert "--inactive 0" in " ".join(subprocess_check_output_spy.command)
 
 
 def test_new_user_try_delete(subprocess_check_output_spy):
     with (AutoNewLinuxUser(TEST_USER, "password")):
         pass
-    assert f"deluser {TEST_USER}" in subprocess_check_output_spy.command
+    assert f"deluser {TEST_USER}" in " ".join(subprocess_check_output_spy.command)