Linux online course

Modify Linux Groups with groupmod and usermod

Learn how to inspect, rename, change, and delete Linux groups, manage supplementary memberships with usermod, understand GIDs and /etc/group, and validate changes safely.

Linux groups provide a convenient way to grant the same access to multiple users. This lesson explains how to inspect groups, modify existing local groups with groupmod, manage supplementary memberships with usermod, and remove groups safely with groupdel.

Local group administration normally requires root privileges. Prefix administrative commands with sudo, or run them from a root shell when appropriate.

Linux group fundamentals

A Linux group is a named collection associated with a numeric group identifier, or GID. The kernel and filesystem store the numeric GID in ownership metadata, while administrators usually work with the more readable group name.

For example, a user might have a primary group named bob with GID 1001, plus supplementary groups such as developers and audio. A file's group ownership is based on a numeric GID even though commands normally display the corresponding name.

Changing a group name does not normally change its GID. Changing a GID is more consequential because existing filesystem objects may still contain the old numeric GID.

Inspect existing groups and memberships

Look up groups with getent

getent queries system databases through NSS, the Name Service Switch. NSS determines whether users and groups are resolved from local files, LDAP, NIS, or other configured sources. Therefore, getent group is usually more reliable than reading only /etc/group.

getent group
getent group developers
getent group 1050

A result might look like this:

test_group:x:1050:bob,jwilliams

This means the group name is test_group, its GID is 1050, and the listed supplementary members are bob and jwilliams. A lookup by numeric GID can help determine whether a GID is already in use.

Inspect a user's groups

Use id USER for a detailed identity report:

id bob

Typical output identifies the user's UID, primary group, and supplementary groups:

uid=1002(bob) gid=1002(bob) groups=1002(bob),1050(test_group),1100(developers)

Use groups USER when you mainly want group names:

groups bob

The member list at the end of a group record does not necessarily contain every user belonging to that group. In particular, users whose primary group is that group may not appear in the comma-separated member field. Use id USER to see the effective primary and supplementary memberships together.

Modify a group with groupmod

groupmod changes attributes of an existing local group. The target group must already exist, the new name must not conflict with another group, and a replacement GID should normally be unused.

Rename a group

Use -n followed by the new name and then the current group name:

sudo groupmod -n test_group test_gr

The group's identity remains tied to its existing GID, so the operation changes the name rather than the numeric ownership identifier. Verify both the new and old names:

getent group test_group
getent group test_gr

The first command should return the group record. The second should normally return no record if the old name is no longer present.

Change a group's GID

First check whether the proposed GID is already assigned:

getent group 1050

If the lookup shows no conflicting group, change the GID:

sudo groupmod -g 1050 test_group
getent group test_group

A GID change updates the group database record, but it does not automatically rewrite every filesystem object that contains the former numeric GID. Identify affected files before attempting any migration:

find /relevant/path -group test_group -ls

Use a narrowly scoped, reviewed chgrp or chown operation to migrate ownership when required. Do not perform an unreviewed recursive ownership change across an entire system.

Non-unique GIDs

A non-unique GID is a numeric GID shared by more than one group name. This is unusual because filesystem permissions use the number, not the name. Two names mapped to one GID therefore represent the same group ownership at the kernel level, which can make reports and audits ambiguous.

Only permit this deliberately, when an application or identity design specifically requires it and the consequences are understood:

sudo groupmod -o -g SHARED_GID GROUP

Normally, choose an unused GID instead of using -o.

Legacy group passwords

The -p option changes a legacy group-password field. Group passwords are not a recommended modern method for granting access: they are difficult to audit and do not provide the clarity of explicit supplementary membership, service authorization, or ACLs. Prefer managing users with usermod and using appropriate permission controls.

Manage supplementary membership with usermod

groupmod changes group attributes; it does not add users to a group's membership list. Use usermod for user membership changes.

Append one supplementary group safely

The option combination -aG appends a group to the user's existing supplementary-group list:

sudo usermod -aG cdrom jwilliams

-G supplies a supplementary-group list, while -a means append rather than replace. The append option must be used together with -G.

Before changing membership, inspect the current state:

id jwilliams
groups jwilliams

After the change, verify both the user's view and the group's resolved record:

id jwilliams
getent group cdrom

Important: -G without -a replaces the list

usermod -G defines the complete supplementary-group list. It does not mean “add this group.” Any existing supplementary group omitted from the list is removed.

sudo usermod -G test_group,developers bob

After this command, bob is intended to have test_group and developers as supplementary groups, but previous supplementary memberships not listed are removed. The user's primary group is not changed by this command.

Replace supplementary groups intentionally

Replacing the complete list is appropriate when an administrator wants to define the exact supplementary roles for an account. It is risky if performed without first recording current memberships.

1. Inspect the user's current identity and memberships.
2. Decide which existing supplementary groups must remain.
3. Construct a complete comma-separated list, including every group that should remain and every new group to add.
4. Run usermod -G with that complete list.
5. Verify the result with id and perform an access test where appropriate.

id bob
sudo usermod -G test_group,developers bob
id bob

Do not confuse this operation with changing the primary group. A user's primary group is changed separately with the primary-group option, commonly usermod -g GROUP USER. Changing supplementary groups with -G does not alter that primary assignment.

Delete groups safely

groupdel removes a local group:

sudo groupdel test_group

Deleting a group is a dependency change, not merely a text-file cleanup. Before removal, check all of the following:

• Users listed as supplementary members.
• Users whose primary group is the target group.
• Files and directories owned by the group's numeric GID.
• Scheduled jobs, services, containers, scripts, and configuration files that refer to the group name or GID.
• Whether the group is managed by a directory service rather than locally.

A group generally cannot be deleted while it is a user's primary group. Assign each affected user an appropriate replacement primary group before trying again. Remove or reassign supplementary memberships as part of the account cleanup, and migrate or deliberately handle files owned by the old GID.

After deletion, verify the name is no longer resolved:

getent group test_group

Understand /etc/group

/etc/group is the conventional local group database. Each record has four colon-separated fields:

group_name:password_placeholder:GID:member1,member2

Use administrative commands such as groupmod, usermod, and groupdel rather than manually editing account databases. Manual edits can create duplicate names, invalid records, or mismatched ownership information.

Also, do not assume that /etc/group contains every group available on the system. With LDAP, NIS, or another NSS source, a group can be returned by getent without appearing in the local file. Such a group must be managed in its authoritative identity provider, not with a local command intended for local records.

Apply and validate membership changes

Group credentials are established for a process, usually when a login session starts. Adding a user to a group does not necessarily update the credentials of shells, desktop sessions, or services that are already running.

After changing membership, log out and back in, start a new login session, or use an appropriate session-refresh method for the environment. Then verify:

id USER
groups USER
getent group GROUP

When access depends on a filesystem permission, perform a permission test as the affected user against the intended path. A group record alone confirms configuration, while the test confirms effective access in the new session.

Commands for group and membership administration

Troubleshooting

A user lost access to previous groups

The likely cause is using usermod -G without -a. The supplied list replaced the prior supplementary memberships.

id USER
sudo usermod -G GROUP_THAT_MUST_REMAIN,NEW_GROUP USER
id USER

For a single additional group in the future, use sudo usermod -aG NEW_GROUP USER.

The new membership is not visible in the current shell

The active session probably has old group credentials. Log out and back in or begin a new login session, then run id USER. A command launched from the old session may continue to lack the new access.

groupmod rejects a new name

Another group may already use the requested name, or the name may violate local naming policy:

getent group NEW_NAME

Choose an unused, valid name and retry.

groupmod rejects a new GID

The GID may already belong to another group:

getent group NEW_GID

Prefer an unused GID. Use duplicate-GID behavior only for a specifically designed exceptional configuration.

Files still have the old group ownership after a GID change

Filesystem objects store numeric GIDs. Changing the group database entry does not automatically rewrite objects that contain the former number. Identify affected objects with a narrowly scoped search and migrate them deliberately with a reviewed chgrp or chown operation. For broader ownership guidance, see Manage File Ownership.

groupdel reports that the group is a primary group

At least one account uses the group as its primary group. Find affected accounts with id or by reviewing the user database, assign each account an appropriate replacement primary group, and then retry deletion.

A group is returned by getent but absent from /etc/group

The group likely comes from LDAP, NIS, or another NSS source. Confirm the configured identity source and manage the record through its authoritative provider. A local groupmod command is not the correct tool for modifying a directory-managed group.

Exam-relevant notes

• groupmod modifies group attributes; it does not add users to a group.
• usermod -aG GROUP USER appends a supplementary group without replacing existing supplementary memberships.
• usermod -G GROUP1,GROUP2 USER replaces the complete supplementary-group list.
• -a must be combined with -G.
• A primary group and supplementary groups are different account attributes.
• A group name is not the same as its numeric GID.
• The fourth field of /etc/group lists supplementary members and may omit users whose primary group is that group.
• Use getent when NSS or directory-backed identity sources may be involved.
• Existing sessions may need to be restarted before new memberships affect commands and permission checks.
• Before deleting a group, check users, primary-group assignments, files owned by its GID, and service configuration.