VMware ESXi and vSphere Cluster Management

Modify Linux Groups with groupmod and usermod

Learn to rename and delete Linux groups, change GIDs, manage supplementary memberships safely, inspect /etc/group, and verify permission changes.

Why Linux groups matter

A Linux group is a named collection of accounts used to grant shared permissions and access controls. Instead of assigning access to every user individually, you can make a directory, device, or service accessible to a group and then manage the group’s membership.

A user has one primary group. This is the account’s default group and is commonly used as the group owner of newly created files. A user can also have zero or more supplementary groups, which provide additional access beyond the primary group.

Local group data is commonly stored in local account databases such as /etc/group. Enterprise systems may obtain group information from LDAP, Active Directory, or another directory service. Linux uses NSS, the Name Service Switch, to determine which configured sources are queried. Therefore, a group shown by the system is not necessarily stored in a local file.

Primary and supplementary groups

Group ownership is recorded numerically using a GID, or group identifier. Names make administration easier, but the kernel and filesystem permission metadata use numeric IDs.

• Primary group: the user’s default group, identified in the user account database.
• Supplementary group: an additional group that grants the user access to shared resources.
• GID: the numeric identifier used for group ownership and access checks.

Inspect existing groups and memberships

Always inspect the current state before changing an account or group. This helps prevent accidental loss of access and gives you a record for rollback.

View a user’s groups

groups bob
id bob

groups displays group names in a concise form. id provides more detail, including the user’s UID, primary GID, primary group name, and supplementary GIDs and names.

Look up a group with getent

getent group test_gr
getent group 2500

getent group queries the configured group databases. Unlike a command that reads only /etc/group, getent can use all group sources configured through NSS, such as local files or LDAP.

The second command looks up a group by numeric GID. Use it before assigning a new GID so you can check whether the target number is already in use.

Identify a group’s GID

getent group project

A result such as project:x:1800:alice,bob identifies project as the group name, x as the password placeholder, 1800 as the GID, and alice,bob as listed supplementary members.

Modify an existing group with groupmod

groupmod is the administrative utility for changing properties of an existing local group. Its general form is:

groupmod [options] GROUP

Administrative privileges are required for these changes, so commands normally use sudo. A rename or GID change can affect group references, file ownership interpretation, services, and access-control rules. Verify permissions and dependent resources after making a change.

Rename a group safely

Renaming changes the human-readable name while retaining the group’s numeric identity. Users assigned to the group continue to reference the same group identity because the GID does not change.

1. Verify that the old group exists.
2. Choose a replacement name that is not already used.
3. Run groupmod -n with administrative privileges.
4. Verify the new record and inspect affected permissions or configuration.

getent group test_gr
getent group test_group
sudo groupmod -n test_group test_gr
getent group test_group
getent group test_gr

The second lookup before the change checks that the replacement name is available. Afterward, the old name should no longer resolve through the relevant group database.

Change a group’s numeric GID

A group name is a human-readable label. The GID is the numeric value stored in ownership metadata and used during permission checks. Changing a GID therefore requires more care than changing only a name.

1. Inspect the current group and its GID.
2. Check that the requested GID is unused.
3. Change the group’s GID.
4. Inspect group records and relevant filesystem ownership afterward.

getent group project
getent group 2500
sudo groupmod -g 2500 project
getent group project
ls -l /srv/project
find /srv/project -group 1800 -ls

On many systems, changing the group database entry does not rewrite every file’s stored numeric group ownership. Files that still contain the old GID may display a number or resolve to a different group than expected. Use ls -l for a targeted check and find to audit a larger path. Update ownership carefully with appropriate ownership tools when required.

Do not use -o merely to bypass an error. Normally each GID should identify one group. A duplicate GID should be used only for a deliberate, documented compatibility configuration.

Manage supplementary group membership with usermod

groupmod changes group properties; it is not the normal tool for adding users to a group membership list. Use usermod for a user’s supplementary groups.

Append membership safely with usermod -aG

The preferred form for adding one or more supplementary groups is usermod -aG. The -a means append, and -G specifies supplementary groups.

id bob
sudo usermod -aG test_group bob
id bob

This grants bob membership in test_group while retaining existing supplementary memberships.

Multiple groups are supplied as a comma-separated list:

sudo usermod -aG developers,qa alice

For another example, add jwilliams to the hardware-access group cdrom without removing current memberships:

groups jwilliams
sudo usermod -aG cdrom jwilliams
groups jwilliams

The destructive behavior of usermod -G

usermod -G without -a replaces the user’s entire supplementary-group list. It does not mean “add this group.” Inspect the current memberships first, then include every supplementary group the user should retain.

id alice
sudo usermod -G developers,qa alice
id alice

After this operation, alice has only the supplementary groups listed in the command, subject to system and account-database behavior. Omitting a previously required group can immediately remove access after the user starts a new session.

Remove a supplementary membership

To remove a supplementary group with usermod, reset the list to the complete set of groups that should remain:

id bob
sudo usermod -G developers,qa bob
id bob

Here, test_group is removed only if it was previously present and developers,qa are the complete approved remaining list. Some distributions also provide gpasswd -d USER GROUP for removing one membership directly, but the replacement behavior of usermod -G remains important to understand.

Group changes may not appear in an already-running shell or application. Have the user start a new login session. A long-running service may need a controlled restart so it obtains fresh group credentials.

Delete an obsolete group

groupdel removes an unneeded local group:

getent group oldproject
sudo groupdel oldproject
getent group oldproject

Before deletion, check whether the group is the primary group of any user, appears in supplementary memberships, owns files, is referenced by services or scheduled jobs, or is used in ACLs. A group generally cannot be deleted while it remains the primary group of an existing user.

• Find accounts whose primary GID matches the group’s GID.
• Review supplementary memberships and service accounts.
• Search relevant filesystems for the group’s numeric ownership.
• Inspect ACLs and service configuration where group-based access is important.
• Reassign or clean up dependencies before running groupdel.
• Verify that the group no longer resolves and that required resources still work.

Understand the /etc/group format

/etc/group is the local group database file. A typical record has this form:

test_group:x:1700:alice,bob

The fourth field represents supplementary memberships. A user’s primary group is recorded in the user account database, such as /etc/passwd, and does not necessarily appear in this member list.

For routine inspection, prefer getent group because it follows configured NSS sources:

grep '^test_group:' /etc/group
getent group test_group

Directly editing account database files is error-prone. Use administrative commands such as groupmod, usermod, groupadd, and groupdel so validation and account-database conventions are handled consistently. If getent shows a directory-backed group that is absent from /etc/group, administer it through its authoritative directory service.

Verification and operational safety

Perform changes in a maintenance-aware manner on shared systems. Record the original group name, GID, memberships, relevant file ownership, and intended result before changing access controls.

After modifications, use getent to verify the group record, groups or id to verify account membership, and ls -l or find to inspect filesystem ownership. For permission failures, also inspect ACLs, parent-directory execute permissions, and service configuration.

Troubleshooting common problems

A user loses access after a group change

The likely cause is usermod -G being used without -a. It replaced the old supplementary list. Inspect the intended memberships with id or groups, then restore the complete list with usermod -G or add missing memberships with usermod -aG.

The membership looks correct but access is denied

The current shell or application may still have its old supplementary credentials. Start a new login session or restart the affected service. Then check id, ls -l, ACLs, and execute permission on every parent directory.

groupmod refuses a requested GID

Another group probably already owns that GID. Run getent group GID, choose an unused value, and use -o only when duplicate IDs are explicitly justified and documented.

A group cannot be deleted

It may still be the primary group of a user or be referenced by system configuration. Identify dependent accounts, reassign primary groups where appropriate, review files and services, and retry groupdel.

A renamed group is absent from /etc/group

The group may come from LDAP or another NSS source rather than a local file. Use getent group to query the active source and make changes through the authoritative directory service.

Files show an unexpected numeric group

Filesystem metadata may still contain the old GID, or identity sources may map the number inconsistently. Audit paths with find, confirm the intended mapping with getent, and update file group ownership carefully where required.

Exam-relevant notes

• groupmod -n NEW OLD renames a group; it does not change the GID.
• groupmod -g GID GROUP changes the numeric identifier and requires ownership verification.
• usermod -G replaces supplementary groups.
• usermod -aG appends supplementary groups and is usually the safe choice for adding access.
• The member list in /etc/group describes supplementary memberships; primary membership is stored with the user account.
• getent queries configured NSS databases, not only local files.
• A running process may retain old group credentials until a new login or service restart.
• Document group purpose and membership so access-control reviews can identify unnecessary privileges.

For a related reference, see Modify Linux groups.