VMware ESXi and vSphere Cluster Management

Modify Linux User Accounts with GUI Tools and usermod

Learn how to modify existing Linux users with desktop settings and usermod, including names, homes, shells, groups, passwords, locks, and expiration.

Modifying a Linux user account means changing properties of an account that already exists. This differs from creating a user or deleting one. Common changes include the login name, home directory, login shell, groups, password, account type, language, automatic login, and account access state.

A local user account is defined on the computer itself, commonly through account databases such as /etc/passwd and /etc/shadow. Accounts supplied by LDAP, Active Directory, or another identity service must usually be changed through that service instead.

Administrative privileges are normally required. Use sudo or a root session for changes to another user's account. Confirm the target account and intended result before running a command.

Modify accounts with desktop settings

On a Linux desktop, open Settings or System Settings, then look for Users, User Accounts, or a similar panel. The exact location and wording vary among GNOME, KDE Plasma, distributions, and release versions.

Open the user-account panel.
Select Unlock or an administrator control.
Authenticate with an administrator password.
Select the existing account to edit.
Change the required setting and confirm or apply the change.

Depending on the desktop and distribution, the panel may provide controls for:

Account type: standard user or administrator.
Password: set or change the account password.
Language: select the desktop display language or regional settings.
Automatic login: sign in without requesting a password at boot.
User image: choose a profile picture where supported.

GUI tools are convenient, but they do not expose every account field. A graphical account-type change may alter group membership or a distribution-specific policy rather than one universal setting. Language and automatic-login settings are also desktop or display-manager configuration, not simply usermod fields. Login name, home directory, shell, groups, expiration, and lock state are generally more consistently handled with command-line tools.

The usermod command

usermod is the principal command for changing attributes of an existing local user. Its general form is:

sudo usermod [options] USER

USER is the current login name unless an option changes it. Before applying a change, check that the account exists and that the option will produce the intended result:

getent passwd USER
id USER

Option	Purpose	Example	Important behavior or caution
`-l`	Change the login name	`sudo usermod -l NEW OLD`	Does not rename the home directory automatically.
`-d`	Set the configured home path	`sudo usermod -d /home/new USER`	Changes the account field; it does not move files by itself.
`-m`	Move existing home contents	`sudo usermod -d /home/new -m USER`	Use with `-d`; verify destination, ownership, and available space.
`-s`	Set the login shell	`sudo usermod -s /bin/bash USER`	Use an existing shell, normally listed in `/etc/shells`.
`-g`	Change the primary group	`sudo usermod -g developers USER`	The group must exist; new files commonly use this group.
`-G`	Set supplementary groups	`sudo usermod -G developers,web USER`	Replaces the existing supplementary-group list.
`-aG`	Append supplementary groups	`sudo usermod -aG developers USER`	Preserves existing supplementary memberships and is usually the safe choice for adding a group.
`-L`	Lock password authentication	`sudo usermod -L USER`	Does not necessarily terminate sessions or block every authentication method.
`-U`	Unlock the stored password	`sudo usermod -U USER`	Does not override expiration, shell, SSH, or external identity policy.
`-e`	Set or clear account expiration	`sudo usermod -e 2026-12-31 USER`	Use an ISO date; an empty value can clear expiration on implementations that support it.
`-f`	Set inactivity handling after password expiration	`sudo usermod -f 14 USER`	Specifies days after password expiration before the account is disabled.

Change a login name

The login name is the username used to authenticate and identify an account. Change it with -l:

sudo usermod -l jowilliams jwillams
getent passwd jowilliams
id jowilliams

This changes the account's login name but leaves the old home-directory path unchanged. A rename can also require updates to scripts, scheduled tasks, service configurations, remote-access settings, ownership records, and applications that contain the old name or path.

Do not rename an account while it is running important processes if you can avoid it. Plan a maintenance window, identify references to the old name, and ensure that another administrative account or a recovery console is available. A complete rename with a matching home path is:

sudo usermod -l jowilliams -d /home/jowilliams -m jwillams
getent passwd jowilliams
ls -ld /home/jowilliams
sudo find /home/jowilliams -maxdepth 1 -printf '%u:%g %p\n'

Move or change the home directory

A home directory is the default location for a user's personal files and configuration. Use -d to change the path recorded for the account:

sudo usermod -d /srv/home/jowilliams jowilliams

This changes the configured path but does not physically move the existing files. Add -m when the contents should be moved:

sudo usermod -d /home/jowilliams -m jowilliams

After migration, check that the destination exists, contains the expected files, and is owned by the correct user and group. Also search for files outside the home directory that still belong to the account and review application configuration that refers to the former path.

Change the default shell

The login shell is the program launched for an interactive command-line login. Set it with -s:

sudo usermod -s /bin/bash jowilliams
getent passwd jowilliams
grep -Fx /bin/bash /etc/shells

The shell binary should exist and be executable. Standard login services normally require an interactive shell to appear in /etc/shells. A noninteractive shell such as /usr/sbin/nologin or /bin/false can prevent interactive logins, which is useful for service accounts but inappropriate when the user needs a terminal.

Manage primary and supplementary groups

A primary group is the account's default group and is commonly used for newly created files. A supplementary group is an additional membership that grants access to resources such as shared directories or devices.

sudo usermod -g developers jowilliams
sudo usermod -aG developers,qa jowilliams
id jowilliams
groups jowilliams

Use -aG to add groups while preserving existing supplementary groups. Using -G without -a replaces the entire supplementary list, so first record the complete intended list if replacement is deliberate.

Group membership is normally established when a session starts. Ask the user to log out and back in, or start a new session, before testing the new permissions. Membership alone does not override filesystem permissions, ACLs, or other security policy.

Change passwords and password aging

passwd changes or resets a local user's password. It prompts interactively, so the password is not exposed in shell history:

sudo passwd jowilliams
sudo passwd -S jowilliams

Do not place passwords directly in a command line or script unless a controlled, secure mechanism specifically requires it. passwd -S reports password status, but it is not a complete account-access diagnosis.

Password aging controls password expiration, warning periods, and behavior after a password expires. Inspect the policy with:

sudo chage -l jowilliams

Depending on the distribution and required policy, chage can set minimum or maximum password age, warning days, the last-change date, and inactivity handling. Resetting a password is different from locking an account: a reset replaces the credential, while a lock marks the stored password so password authentication is rejected.

Lock and unlock accounts

Use -L to lock password-based authentication and -U to unlock it:

sudo usermod -L jowilliams
sudo passwd -S jowilliams
sudo usermod -U jowilliams
sudo passwd -S jowilliams

Lock behavior depends on the authentication stack. It may not stop an existing session, revoke an SSH key, or block authentication through another identity provider. Inspect SSH configuration, active sessions, account expiration, and external authentication sources separately.

For broader access control, consider a suitable combination of an expiration date and a noninteractive shell, understanding that these also affect services and automation:

sudo usermod -e 2026-12-31 contractor1
sudo usermod -s /usr/sbin/nologin contractor1
sudo chage -l contractor1

Account expiration and inactivity

Account expiration is a date after which the account cannot log in. It is useful for temporary accounts, contractors, and time-limited projects:

sudo usermod -e 2026-12-31 contractor1
sudo chage -l contractor1

The -f option configures the number of days after password expiration before the account is disabled:

sudo usermod -f 14 contractor1

Use a documented end date and review whether scheduled jobs, service accounts, SSH keys, or automation also need to be disabled. Clearing an expiration date should be done deliberately and verified with chage -l.

GUI settings and command-line equivalents

Account setting	Typical GUI location	Command-line tool	Security or operational consideration
Password	Users, account, Password	`passwd USER`	Use interactive prompts; review aging separately.
Account type or administrator access	Users, account type	Distribution-specific group or policy tools	Administrator membership grants substantial privilege.
Automatic login	Users or Login Screen settings	Display-manager configuration	Anyone reaching the device may enter the session without a password.
Language	Users, Language or Region	Desktop and locale tools	Usually affects the desktop session rather than the account database.
Login name	Often unavailable in GUI	`usermod -l`	Review paths, scripts, jobs, services, and remote access.
Home directory	Often unavailable in GUI	`usermod -d`, `-m`	Changing the path and moving files are separate actions.
Default shell	Usually unavailable in GUI	`usermod -s`	A noninteractive shell blocks normal terminal login.
Account lock state	Some panels provide Disable or Lock	`usermod -L`, `-U`	Check other authentication methods and existing sessions.

Verify account changes

What to verify	Command	Expected information
User identity and group IDs	`id USER`	UID, primary GID, and supplementary groups.
Account database entry	`getent passwd USER`	Login name, UID, primary GID, comment, home path, and shell.
Password status	`sudo passwd -S USER`	Password status such as locked or usable, subject to platform format.
Password and account aging	`sudo chage -l USER`	Password dates, expiration, warning, and inactivity information.
Home path and ownership	`ls -ld /path/to/home`	Directory existence, owner, group, and permission mode.
Supplementary groups	`groups USER`	The groups associated with the account.

Safe administration practices

Use sudo carefully and confirm the username before pressing Enter.
Avoid manually editing /etc/passwd or /etc/shadow for routine changes. Use account-management commands so validation and related updates are handled correctly.
Do not change the account used for the current administrative session without another administrator, a tested recovery path, and a plan for active processes.
Before a home migration or rename, document the old and new values, check available storage, and identify jobs, services, scripts, and remote-access configuration that depend on them.
In managed environments, back up or record significant changes according to local change-control rules.

Troubleshooting

The command says that the user does not exist

Check the spelling and local account database:

getent passwd USER

If no entry appears, determine whether the identity comes from LDAP, Active Directory, or another directory service. Change it using the appropriate identity-management system rather than local usermod.

The renamed user still has the old home directory

Inspect the configured path:

getent passwd NEW_USER

Use usermod -d /new/path -m USER only after confirming the migration plan. Then check the destination's ownership and contents.

The user lost group access

Run id USER. If usermod -G was used without -a, the previous supplementary list was replaced. Restore the complete intended list and have the user start a new login session.

The user cannot log in after a shell change

Inspect the shell field with getent passwd USER. Confirm that the binary exists, is executable, and that an intended interactive shell appears in /etc/shells. Restore a valid shell if command-line access is required.

Unlocking does not restore access

Check both password status and aging:

sudo passwd -S USER
sudo chage -l USER
getent passwd USER

The account may still be expired, assigned a noninteractive shell, restricted by an authentication-service policy, or controlled by an external identity provider. Also inspect SSH settings and keys when remote access is involved.

New group permissions are not visible

Confirm membership with id USER, then have the user log out and back in or start a new session. If access still fails, check filesystem permissions and ACLs separately from group membership.

Exam-relevant notes

usermod -l changes the login name, not automatically the home-directory name.
usermod -d changes the configured home path; -m requests that existing contents be moved.
-aG appends supplementary groups. -G without -a replaces them.
usermod -L locks password authentication; it is not guaranteed to terminate sessions or disable SSH keys.
passwd changes a password, while account locking changes whether the stored password can authenticate.
Account expiration, password expiration, shell restrictions, and external authentication are separate controls and should be checked separately.