Linux online course

Modify Existing Linux User Accounts

Learn how to modify existing Linux users with the User Accounts desktop tool, usermod, and passwd, including names, homes, shells, groups, passwords, and locks.

Linux user accounts can usually be adjusted without deleting and recreating them. You can change an account's login name, home directory, shell, groups, password, expiration settings, or access state while preserving its numeric identity and much of its existing data.

A user account is a local identity represented by account records. These records define a username, numeric user ID (UID), group memberships, home directory, login shell, and authentication settings. The main local account files include /etc/passwd, which contains identity fields, and the protected /etc/shadow, which contains password hashes and password-aging information.

Graphical and command-line account administration

Desktop Linux distributions commonly provide a User Accounts panel in the system settings application. It is convenient for common desktop settings such as account type, preferred language, password, and automatic login.

The command-line usermod program is more precise and exposes settings that many graphical tools do not. The passwd program is normally used to set or change passwords.

Many account changes require administrator authentication. In a terminal, an authorized administrator generally runs commands with sudo. In a graphical tool, an administrator may need to unlock the panel by entering an administrator password.

Modify a user with the User Accounts tool

1. Open the desktop's system settings application.
2. Locate User Accounts, Users, or a similarly named account-management panel.
3. Select Unlock or the equivalent administrative control.
4. Authenticate with an administrator password.
5. Select the account you want to modify.
6. Change the available settings and confirm each change as required.

Common controls include the account type, preferred language, password, and automatic login. Automatic login is desktop-manager behavior that signs a selected account in automatically when the system starts.

Account types may be labeled differently. For example, a desktop may offer standard and administrator accounts. Language controls may affect the user's desktop locale rather than every language setting on the system. Available controls and wording vary by desktop environment and Linux distribution.

Using usermod

usermod is the standard command-line tool for changing attributes of an existing local Linux account. Its general form is:

sudo usermod [options] USERNAME

The target account must normally not be actively running important processes while identity-related changes are made. Changes to account records may also require updates elsewhere: usermod does not automatically move every file, update scheduled jobs, change service configuration, or repair references stored by applications.

Common usermod options

Option — Purpose — Example use — Important caution

-l — Change the login name — sudo usermod -l jowilliams jwillams — Does not rename or move the home directory by itself.

-d — Set the configured home-directory path — sudo usermod -d /home/newname USERNAME — Changes the record but does not move existing contents unless combined with -m.

-m — Move existing home contents when used with -d — sudo usermod -d /home/newname -m USERNAME — Check available space, ownership, and active processes first.

-s — Set the login shell — sudo usermod -s /bin/zsh USERNAME — The shell should exist and normally be listed in /etc/shells.

-g — Set the primary group — sudo usermod -g GROUP USERNAME — The group must exist; changing it affects default group ownership of new files.

-G — Replace supplementary group membership — sudo usermod -G project USERNAME — Existing supplementary groups are removed unless included in the new list.

-aG — Append supplementary group membership — sudo usermod -aG project USERNAME — Prefer this form when adding a group without removing existing groups.

-L — Lock the password — sudo usermod -L USERNAME — Does not necessarily terminate sessions or disable key-based access.

-U — Unlock the password — sudo usermod -U USERNAME — Restores password authentication only if other account policies allow it.

-e — Set an account-expiration date — sudo usermod -e 2026-12-31 USERNAME — Use the date format supported by the installed tools and confirm the intended policy.

-f — Set the number of days after password expiration before the account becomes inactive — sudo usermod -f 14 USERNAME — This controls inactivity after password expiration, not ordinary session duration.

Change a login name

The -l option changes the login name used to identify an account. For example, this command changes the misspelled login name jwillams to jowilliams:

sudo usermod -l jowilliams jwillams

Changing the login name does not inherently rename or move the home directory. The account could therefore use the new login name while its home remains /home/jwillams.

After a rename, check file ownership, active sessions, scheduled jobs, service references, scripts, shared directories, SSH configuration, and application configuration. Files are owned by numeric UIDs, so ownership may still be correct, but paths and text references containing the old name may not be.

Change a home directory

The -d option sets the home directory recorded for an account:

sudo usermod -d /home/newname USERNAME

This changes the configured path only. It does not necessarily move the existing home-directory contents. To set a new path and move the contents from the old location, use -m together with -d:

sudo usermod -d /home/newname -m oldname

Before moving a home directory, check free space, mounted filesystems, active processes, permissions, and backup status. Afterward, inspect the new directory and confirm that files retain the intended ownership.

Change the default login shell

A login shell is the command interpreter started for an interactive login. Bash and Zsh are common examples. Set a user's shell with -s:

sudo usermod -s /bin/zsh USERNAME

To use Bash instead, specify /bin/bash. The target path must point to an installed executable and should normally appear in the approved-shells file, commonly /etc/shells. Check the file before making the change:

grep -E '(/bin/bash|/bin/zsh)' /etc/shells

An incorrect or disallowed shell can prevent a normal interactive login. Keep an administrator session available while testing a shell change.

Modify group membership

The primary group is the account's default group and is commonly used as the group owner for newly created files. Set it with -g:

sudo usermod -g developers USERNAME

Supplementary groups are additional memberships that grant access to files, devices, services, or administrative capabilities. The -G option replaces the complete supplementary-group list:

sudo usermod -G project,developers USERNAME

Because -G replaces the list, using it carelessly can remove important access. To append one group while preserving existing supplementary memberships, use -aG:

sudo usermod -aG administrators USERNAME

Group changes generally take effect for new login sessions. Have the user log out and back in before testing access.

Lock and unlock an account

An account lock disables password-based authentication by locking the account's password credential. It does not delete the account or its files.

sudo usermod -L USERNAME
sudo usermod -U USERNAME

Use -L to lock password access and -U to unlock it. Password locking does not necessarily terminate existing sessions or prevent non-password methods such as an already authorized SSH key, depending on system configuration. For urgent access removal, review active sessions, authorized SSH keys, other identity providers, and remote-access policy.

Change a user's password with passwd

passwd is the normal program for setting or administering passwords. An administrator can reset jwillams's password with:

sudo passwd jwilliams

The terminal does not display password characters while you type. The command prompts for the new password and then requests it a second time for confirmation. Password-quality rules may reject weak or reused passwords.

An administrator resetting another user's password uses sudo passwd USERNAME. A user changing their own password normally runs passwd without a username; they must usually provide the current password first. The exact behavior can vary with authentication policy.

Graphical versus command-line modification

Task — User Accounts GUI — Command-line tool — Administrative considerations

Change account type — Often available — Desktop-specific tools or group administration — Requires administrator authentication and may alter administrative group membership.

Set language — Commonly available — Usually desktop or locale configuration rather than usermod — The setting may affect only the desktop session.

Change password — Commonly available — sudo passwd USERNAME — Password policy and privilege checks apply.

Enable or disable automatic login — Commonly available — Desktop-manager configuration — Exposes the account at startup and is distribution-specific.

Rename login — Often unavailable — sudo usermod -l NEWNAME OLDNAME — Check paths, jobs, services, sessions, and references.

Move home directory — Often unavailable — sudo usermod -d PATH -m USERNAME — Plan the file move and verify ownership.

Change shell — Sometimes unavailable — sudo usermod -s SHELL USERNAME — Check the executable and /etc/shells.

Manage group membership — Sometimes limited — sudo usermod -aG GROUP USERNAME — Avoid replacing groups accidentally with -G.

Lock or unlock password access — Sometimes available — sudo usermod -L or -U — Locking does not necessarily stop existing or key-based access.

Verify account changes

Use independent queries after modifying an account. These commands resolve account information through the system's configured identity sources:

Command — What it verifies — Example target

id USERNAME — UID, primary GID, and group memberships — id jowilliams

groups USERNAME — The user's supplementary and effective group names — groups jowilliams

getent passwd USERNAME — Resolved username, UID, GID, home directory, and shell — getent passwd jowilliams

ls -ld /home/USERNAME — Home-directory existence, owner, group, and permissions — ls -ld /home/jowilliams

getent group GROUP — Group record and listed members — getent group project

For example, verify the renamed account and its configured home and shell with:

id jowilliams
getent passwd jowilliams
ls -ld /home/jowilliams

If the username changed but the home directory stayed at the old path, inspect that old path explicitly. Also check ownership of files after a move or rename. Do not assume that every external reference was updated.

Safe administration practices

• Avoid modifying an account while it is actively logged in or running important services when practical.
• Keep a separate administrator session available before changing a shell, groups, password, or access state.
• Use a backup or maintenance plan before modifying accounts on important systems.
• Do not edit /etc/passwd or /etc/shadow directly. Use account-management commands or distribution-specific procedures.
• Remember that local tools may not manage accounts supplied by LDAP, Active Directory, or another external identity service.
• Record the old and new values when changing names, homes, groups, or shells so that dependent jobs and services can be reviewed.

Troubleshooting

The graphical settings are unavailable

The panel may still be locked, the current account may lack administrator privileges, or the desktop environment may use a different account tool. Unlock it with an administrator credential, use an authorized administrator account, or use usermod and passwd for settings the GUI does not expose.

A user loses access after a group change

The likely cause is using -G, which replaced the existing supplementary-group list. Restore required memberships and use -aG for future additive changes. Have the user start a new login session, then verify with id or groups.

The username changed but the old home remains

This is expected when only -l was used. Set and move the home explicitly with usermod -d NEW_PATH -m USERNAME if that is the intended result. Then verify ownership and update references to the former username.

A new shell prevents login

Check that the shell binary exists, that its path is correct, and that the path is listed in /etc/shells. From a separate administrator session, assign a valid shell such as /bin/bash or /bin/zsh.

A locked account still appears to have access

An existing session may still be active, or SSH key authentication may remain enabled. Review and terminate active sessions when appropriate, inspect authorized SSH keys, and treat password locking as only one part of disabling access.

A password reset fails

Confirm that the command was run with sufficient privileges, use a password that meets local quality rules, and determine whether the account comes from a local account database or an external identity service.

Exam-relevant notes

• usermod -l changes the login name, not automatically the home-directory path.
• usermod -d changes the configured home path; combine it with -m to request a move of existing contents.
• usermod -G replaces supplementary groups, while usermod -aG appends a group.
• usermod -g changes the primary group.
• usermod -L and -U lock and unlock password credentials; they do not guarantee termination of every access method.
• sudo passwd USERNAME lets an authorized administrator set another user's password.
• Verify changes with id, getent passwd, groups, and home-directory inspection.