LFCS 33 🐧 Deleting Users and Groups - KandZ

Deleting an account is not the reverse of creating one. The account leaves traces: a home directory, a mail spool, a crontab, running processes, file ownership across the filesystem, and entries in /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. The userdel and groupdel commands remove the account entries, but the rest of the cleanup is the administrator’s responsibility. A user deleted without removing the home directory leaves a directory owned by a UID that no longer has a name. A group deleted while a user still has it as a primary group is refused outright. This chapter covers the deletion commands, the flags that control how much is removed, and the verification steps that confirm the account is actually gone.

Key point: userdel and groupdel remove the account entries, not the account’s data. The home directory, mail spool, and file ownership survive unless explicitly removed or reassigned. Deleting the entry without cleaning up the data leaves orphaned files owned by numeric UIDs that no longer resolve to names.

Why account deletion needs care

The orphaned-file problem. Every file on the system has an owner identified by UID and GID. When an account is deleted, the UID no longer resolves to a name. The ls -l output shows a number instead of a username, and the file is effectively owned by nobody. If the UID is later reused for a new account, the new user inherits ownership of the old user’s files, which is a security problem.

The running-process problem. A user may have running processes when the account is deleted. The processes continue to run with the old UID, and they keep whatever resources they hold open. Deleting the account does not terminate the processes. They must be killed explicitly.

The home-directory problem. The userdel command does not remove the home directory unless -r is passed. On a system with many accounts, the home directories accumulate and consume disk space. On a shared system, they may also contain data that the administrator wants to archive before deletion.

The mail-spool problem. User mail is stored in /var/mail/<user> or /var/spool/mail/<user>. The userdel command with -r does not remove the mail spool on all distributions. The spool must be removed manually if it is not wanted.

The crontab problem. A user’s crontab entries are stored in /var/spool/cron/crontabs/<user> on Debian-family systems and /var/spool/cron/<user> on Red Hat-family systems. The userdel command removes them on most distributions, but the behavior varies. Checking after deletion is prudent.

The primary-group problem. A group cannot be deleted while a user has it as their primary group. The groupdel command refuses with an error. The user’s primary group must be changed first, or the user must be deleted first.

The audit problem. In regulated environments, deleting an account is a recordable event. The account’s files may need to be preserved for a retention period, and the deletion itself must be logged. The administrator should confirm the policy before running the deletion command.

a. Deleting users with userdel

The userdel command removes the user’s entries from /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. It does not remove the home directory, the mail spool, or any other files unless the appropriate flag is passed.

The basic deletion

The simplest form removes the account entries and leaves everything else.

sudo userdel alice

The user is removed from /etc/passwd and /etc/shadow. The home directory /home/alice remains, owned by the old UID. The mail spool remains. Any files owned by the user elsewhere on the filesystem remain.

The home directory removal

The -r flag removes the home directory and the mail spool along with the account entries.

sudo userdel -r alice

The -r flag removes /home/alice and its contents, and it removes /var/mail/alice or /var/spool/mail/alice. Other files owned by the user elsewhere on the filesystem are not affected.

The force flag

The -f flag forces the deletion even if the user is logged in. It also forces the removal of the home directory with -r even if the directory has files owned by other users.

sudo userdel -f alice
sudo userdel -rf alice

The -f flag should be used with care. Forcing the deletion of a logged-in user can leave processes running under a nonexistent UID.

The files owned elsewhere

Neither userdel nor userdel -r removes files owned by the user outside the home directory. Those files must be found and either reassigned or deleted.

sudo find / -uid 1001 -exec ls -ld {} \; 2>/dev/null

The command finds every file owned by UID 1001. The administrator decides whether to reassign the files to another user with chown, delete them, or leave them.

The running processes

Before deleting a user, check for running processes and terminate them.

sudo ps -u alice
sudo pkill -u alice

The ps -u alice command lists the user’s processes. The pkill -u alice command sends SIGTERM to each. A second pkill -9 -u alice may be needed if some processes ignore the signal.

The crontab

The user’s crontab is usually removed by userdel, but the behavior varies. Check and remove it manually if it persists.

sudo ls /var/spool/cron/crontabs/alice  # Debian-family
sudo ls /var/spool/cron/alice           # Red Hat-family
sudo crontab -r -u alice                # Alternative removal

The home directory archive

If the account’s data must be preserved, archive it before deleting.

sudo tar czf /backup/alice-home.tar.gz /home/alice
sudo userdel -r alice

The archive retains the ownership information. Restoration with tar xzf and the --same-owner flag restores the original UIDs.

b. Deleting groups with groupdel

The groupdel command removes a group’s entries from /etc/group and /etc/gshadow. It does not affect the files owned by the group.

The basic deletion

sudo groupdel developers

The group is removed from /etc/group and /etc/gshadow. Files owned by the group retain the GID, which now has no name.

The primary-group restriction

The groupdel command refuses to delete a group that is the primary group of any user. The error message identifies the problem.

sudo groupdel developers
# groupdel: cannot remove the primary group of user 'alice'

The user’s primary group must be changed before the group can be deleted.

sudo usermod -g users alice
sudo groupdel developers

Alternatively, delete the user first with userdel, which removes the user’s entry from /etc/passwd and resolves the restriction.

The file-ownership problem

Files owned by the deleted group are not affected. They retain the GID, which now has no name. The ls -l output shows the numeric GID.

ls -l /shared/project
# -rw-rw-r-- 1 alice 1500 ... /shared/project
#                      ^^^^
#                      The GID no longer resolves to a name.

The files must be reassigned to another group or left with the numeric GID. The latter is a problem if the GID is later reused for a new group, because the new group inherits ownership of the old group’s files.

sudo chgrp newgroup /shared/project

The gshadow entry

The groupdel command removes the entry from /etc/gshadow as well as /etc/group. Verify after deletion.

grep developers /etc/group /etc/gshadow
# (no output)

The system group

A system group created with groupadd -r can be deleted with groupdel in the same way. The system GID range is not a restriction on deletion.

c. Cleanup and verification

The deletion commands remove the account entries. The remaining work is finding and handling the traces.

The find command for orphaned files

After deleting a user, find the files that were owned by the old UID.

sudo find / -uid 1001 -print 2>/dev/null

The command lists every file owned by UID 1001. The 2>/dev/null suppresses the “permission denied” errors that appear when find cannot traverse certain directories.

The find command for orphaned groups

After deleting a group, find the files owned by the old GID.

sudo find / -gid 1500 -print 2>/dev/null

The reassignment

Files that should remain accessible are reassigned to another user or group.

sudo chown alice /path/to/file
sudo chgrp developers /path/to/file

The removal

Files that are no longer needed are deleted.

sudo find / -uid 1001 -delete 2>/dev/null

The -delete flag on find removes the files it matches. It should be used only after confirming that no file needs to be preserved.

The verification

After deletion, verify that the account is gone from all four files.

grep alice /etc/passwd /etc/shadow /etc/group /etc/gshadow
id alice

The grep command searches for any remaining entry. The id command reports that the user does not exist. Both should produce no useful output.

The UID reuse consideration

If the UID is later reused for a new account, the new user inherits ownership of any file that still has the old UID. This is why the orphaned files must be handled before the UID is reused. Some administrators reserve the deleted UID for a period or choose a UID that will not be reused.

The audit record

In regulated environments, record the deletion in the system log or in an administrative log.

logger "User alice (UID 1001) deleted by $(whoami)"

The logger command writes to the system log. The record is useful for compliance and for tracing later issues.

Complete Example Session

# ============================================
# PART 1: CHECK THE ACCOUNT BEFORE DELETION
# ============================================

id alice
# uid=1001(alice) gid=1001(alice) groups=1001(alice),1500(developers)

ps -u alice
# (processes, if any)

ls -la /home/alice
# (home directory contents)

ls /var/mail/alice 2>/dev/null
# (mail spool, if any)

# ============================================
# PART 2: TERMINATE RUNNING PROCESSES
# ============================================

sudo pkill -u alice
sudo pkill -9 -u alice

# ============================================
# PART 3: ARCHIVE THE HOME DIRECTORY
# ============================================

sudo tar czf /backup/alice-home-$(date +%F).tar.gz /home/alice

# ============================================
# PART 4: DELETE THE USER WITH HOME
# ============================================

sudo userdel -r alice

# The account entries are removed.
# The home directory and mail spool are removed.

# ============================================
# PART 5: FIND ORPHANED FILES
# ============================================

sudo find / -uid 1001 -print 2>/dev/null
# (list of files still owned by the old UID)

# ============================================
# PART 6: REASSIGN OR DELETE ORPHANS
# ============================================

sudo chown bob /path/to/orphaned/file
sudo find /path/to/temp -uid 1001 -delete 2>/dev/null

# ============================================
# PART 7: DELETE THE GROUP
# ============================================

# First check that no user has it as primary.
grep developers /etc/passwd
# (no output if no user has it as primary)

sudo groupdel developers

# ============================================
# PART 8: FIND ORPHANED GROUP FILES
# ============================================

sudo find / -gid 1500 -print 2>/dev/null

# Reassign or delete.
sudo chgrp newgroup /path/to/file

# ============================================
# PART 9: VERIFY THE DELETION
# ============================================

grep alice /etc/passwd /etc/shadow /etc/group /etc/gshadow
# (no output)

id alice
# id: 'alice': no such user

grep developers /etc/group /etc/gshadow
# (no output)

# ============================================
# PART 10: LOG THE DELETION
# ============================================

logger "User alice (UID 1001) and group developers (GID 1500) deleted"

journalctl -t $(whoami) | tail -5
# Shows the log entry.

The ten parts showed checking the account, terminating processes, archiving the home directory, deleting the user, finding orphaned files, reassigning or deleting orphans, deleting the group, finding orphaned group files, verifying the deletion, and logging the event.

Quick Reference

userdel Options

Option	Purpose
(none)	Remove account entries only
`-r`	Remove home directory and mail spool
`-f`	Force deletion even if logged in

groupdel Options

Option	Purpose
(none)	Remove the group entry

Files Modified by userdel

File	Effect
`/etc/passwd`	User entry removed
`/etc/shadow`	Password entry removed
`/etc/group`	User removed from all member lists
`/etc/gshadow`	User removed from all member lists
`~user/`	Removed with `-r`
`/var/mail/<user>`	Removed with `-r`

Cleanup Commands

Command	Purpose
`find / -uid UID -print`	List files owned by UID
`find / -gid GID -print`	List files owned by GID
`find / -uid UID -delete`	Delete files owned by UID
`chown NEW /path`	Reassign file ownership
`chgrp NEW /path`	Reassign group ownership
`pkill -u USER`	Terminate user’s processes
`logger "message"`	Write to system log

Verification Commands

Command	Purpose
`grep USER /etc/passwd`	Check for user entry
`grep USER /etc/shadow`	Check for password entry
`grep GROUP /etc/group`	Check for group entry
`id USER`	Confirm the user does not exist

Best Practices

✅ Do This:

# Check for running processes before deletion.
ps -u alice  # ✅

# Terminate processes before deleting the user.
sudo pkill -u alice  # ✅

# Archive the home directory if data must be preserved.
sudo tar czf /backup/alice.tar.gz /home/alice  # ✅

# Use -r to remove the home directory and mail spool.
sudo userdel -r alice  # ✅

# Find orphaned files after deletion.
sudo find / -uid 1001 -print 2>/dev/null  # ✅

# Reassign or delete orphaned files.
sudo chown bob /path/to/file  # ✅

# Verify the deletion from all four files.
grep alice /etc/passwd /etc/shadow /etc/group /etc/gshadow  # ✅

# Log the deletion.
logger "User alice (UID 1001) deleted"  # ✅

❌ Don’t Do This:

# Don't delete a user with running processes.
sudo userdel alice  # ❌ Processes continue with orphaned UID

# Don't delete without checking for files outside the home.
sudo userdel -r alice  # ❌ Files elsewhere remain orphaned

# Don't delete a group that is a user's primary group.
sudo groupdel developers  # ❌ Fails with an error

# Don't reuse a UID before orphaned files are handled.
# The new user inherits the old user's file ownership.  # ❌

# Don't use -f unless necessary.
sudo userdel -f alice  # ❌ Can leave processes under a nonexistent UID

# Don't skip verification.
# An entry may remain in one of the four files.  # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Home directory remains	`-r` not used	Use `sudo userdel -r`
Files show numeric UID	Files outside home not cleaned	Find with `-uid` and reassign
Group cannot be deleted	It is a primary group	Change the user’s primary group first
Processes keep running	Not terminated before deletion	Use `pkill -u` first
Crontab remains	Not removed on some distros	Check and remove manually
UID reused inadvertently	New user gets old UID	Handle orphans before reuse
Mail spool remains	Not removed by default	Remove manually or use `-r`
Orphaned group files	Group deleted, GID persists	Find with `-gid` and reassign

Real-World Examples

1. Basic User Deletion

sudo userdel alice

2. Delete with Home Directory

sudo userdel -r alice

3. Terminate Processes First

sudo pkill -u alice && sudo userdel -r alice

4. Archive Before Deletion

sudo tar czf /backup/alice.tar.gz /home/alice && sudo userdel -r alice

5. Find Orphaned Files

sudo find / -uid 1001 -print 2>/dev/null

6. Reassign Orphaned Files

sudo find / -uid 1001 -exec chown bob {} \;

7. Delete Orphaned Files

sudo find /tmp -uid 1001 -delete

8. Delete a Group

sudo groupdel developers

9. Change Primary Group Before Deleting

sudo usermod -g users alice && sudo groupdel developers

10. Verify Deletion

grep alice /etc/passwd /etc/shadow; id alice

Visual

What userdel Removes and What It Leaves

┌────────────────────────────────────────────────────────────┐
│  userdel vs userdel -r                                     │
│                                                            │
│  userdel alice                                             │
│  ┌──────────────────────────────────────────────────┐     │
│  │  REMOVED:                                         │     │
│  │    /etc/passwd entry                              │     │
│  │    /etc/shadow entry                              │     │
│  │    /etc/group membership                          │     │
│  │    /etc/gshadow membership                        │     │
│  │                                                   │     │
│  │  NOT REMOVED:                                     │     │
│  │    /home/alice/                                   │     │
│  │    /var/mail/alice                                │     │
│  │    Files owned elsewhere                          │     │
│  │    Running processes                              │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  userdel -r alice                                          │
│  ┌──────────────────────────────────────────────────┐     │
│  │  REMOVED:                                         │     │
│  │    All of the above, plus:                        │     │
│  │    /home/alice/ and contents                      │     │
│  │    /var/mail/alice                                │     │
│  │                                                   │     │
│  │  NOT REMOVED:                                     │     │
│  │    Files owned elsewhere                          │     │
│  │    Running processes                              │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  Only files outside the home directory require manual     │
│  handling in both cases.                                   │
└────────────────────────────────────────────────────────────┘

Orphaned File Ownership

┌────────────────────────────────────────────────────────────┐
│  ORPHANED FILES AFTER DELETION                             │
│                                                            │
│  BEFORE DELETION                                           │
│  ┌──────────────────────────────────────────────────┐     │
│  │  -rw-r--r-- 1 alice developers ... file1          │     │
│  │  -rw-r--r-- 1 alice alice      ... file2          │     │
│  │  -rw-r--r-- 1 bob   developers ... file3          │     │
│  └──────────────────────────────────────────────────┘     │
│                        │                                   │
│                        │  userdel alice                    │
│                        │  groupdel developers             │
│                        v                                   │
│  AFTER DELETION                                            │
│  ┌──────────────────────────────────────────────────┐     │
│  │  -rw-r--r-- 1 1001 1500 ... file1                 │     │
│  │  -rw-r--r-- 1 1001 1001 ... file2                 │     │
│  │  -rw-r--r-- 1 bob  1500 ... file3                 │     │
│  │                  ^^^^                             │     │
│  │  The UID and GID no longer resolve to names.      │     │
│  │  The files are orphaned.                          │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  Reassign with chown, or accept the numeric IDs.           │
│  If the UID is reused, the new user inherits the files.    │
└────────────────────────────────────────────────────────────┘

The Group Deletion Restriction

┌────────────────────────────────────────────────────────────┐
│  groupdel: PRIMARY GROUP RESTRICTION                       │
│                                                            │
│  Attempt:                                                  │
│  ┌──────────────────────────────────────────────────┐     │
│  │  sudo groupdel developers                         │     │
│  │  groupdel: cannot remove the primary group        │     │
│  │            of user 'alice'                        │     │
│  └──────────────────────────────────────────────────┘     │
│                        │                                   │
│                        v                                   │
│  Fix option 1: Change the user's primary group.            │
│  ┌──────────────────────────────────────────────────┐     │
│  │  sudo usermod -g users alice                      │     │
│  │  sudo groupdel developers                         │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  Fix option 2: Delete the user first.                      │
│  ┌──────────────────────────────────────────────────┐     │
│  │  sudo userdel -r alice                            │     │
│  │  sudo groupdel developers                         │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  The restriction exists because a user without a primary   │
│  group would have no group for new files.                  │
└────────────────────────────────────────────────────────────┘

The Cleanup Workflow

┌────────────────────────────────────────────────────────────┐
│  DELETION WORKFLOW                                         │
│                                                            │
│  1. IDENTIFY                                               │
│     id alice                                               │
│     ps -u alice                                            │
│     ls -la /home/alice                                     │
│                                                            │
│  2. TERMINATE                                              │
│     sudo pkill -u alice                                    │
│                                                            │
│  3. ARCHIVE (optional)                                     │
│     sudo tar czf /backup/alice.tar.gz /home/alice          │
│                                                            │
│  4. DELETE                                                 │
│     sudo userdel -r alice                                  │
│                                                            │
│  5. FIND ORPHANS                                           │
│     sudo find / -uid 1001 -print 2>/dev/null               │
│                                                            │
│  6. REASSIGN OR REMOVE                                     │
│     sudo chown bob /path                                   │
│     sudo find /tmp -uid 1001 -delete                       │
│                                                            │
│  7. DELETE GROUP                                           │
│     sudo groupdel developers                               │
│                                                            │
│  8. VERIFY                                                 │
│     grep alice /etc/passwd /etc/shadow                     │
│     id alice                                               │
│                                                            │
│  9. LOG                                                    │
│     logger "Deleted alice"                                 │
└────────────────────────────────────────────────────────────┘

Summary

Item	Value
`userdel`	Remove user account entries
`userdel -r`	Remove entries plus home and mail
`userdel -f`	Force deletion
`groupdel`	Remove group entries
`/etc/passwd`	User entry removed by `userdel`
`/etc/shadow`	Password entry removed
`/etc/group`	Membership removed
`/etc/gshadow`	Membership removed
`find -uid`	Locate orphaned files
`find -gid`	Locate orphaned group files
`pkill -u`	Terminate user processes
Primary group restriction	Cannot delete a group that is a user’s primary

Key takeaways:

userdel removes the account entry, not the data. The home directory, mail spool, and files owned elsewhere survive unless explicitly removed. The -r flag removes the home and mail spool, but not files outside the home.
Terminate the user’s processes before deletion. A deleted user’s processes continue running under a UID that no longer resolves to a name. Use pkill -u first.
Archive the home directory if the data must be preserved. The tar command retains the ownership information, and tar xzf --same-owner restores it. Do this before running userdel -r.
Find and reassign orphaned files. After deletion, files owned by the old UID show a numeric UID. They should be reassigned or deleted before the UID is reused for a new account.
A group cannot be deleted while it is a user’s primary group. Change the user’s primary group with usermod -g first, or delete the user first.
Group deletion leaves orphaned files. Files owned by the deleted group retain the GID. They must be reassigned to a new group or left with the numeric GID, which is risky if the GID is reused.
Verify the deletion from all four files. The grep command searches /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. The id command confirms that the user no longer exists.
Log the deletion. The logger command writes to the system log. In regulated environments, the record is evidence of the administrative action.

Remember: Deleting an account is not a single command. It is a workflow: identify the account’s traces, terminate its processes, archive its data if needed, remove the account entry, find the files it owned, reassign or delete those files, and verify the deletion. The userdel and groupdel commands remove the account entries, but the home directory, mail spool, and file ownership are the administrator’s responsibility. The -r flag handles the home and mail spool, and the find command with -uid or -gid handles the rest. A group cannot be deleted while a user has it as their primary group. The UID or GID should not be reused until the orphaned files are handled, because the new account inherits the old account’s ownership. The result is a system with no orphaned accounts, no orphaned files, and a clear record of the deletion.

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!