How to Remove Users from Groups in Ubuntu

Removing a user from an Ubuntu group takes away the access that group gave them: shared system folders, devices and special permissions. A group is a named list of accounts. Ubuntu checks that list whenever someone tries to open or change a file, use a device or run an admin command.

You do this work in the terminal, the text-based command window built into Ubuntu releases such as Ubuntu 22.04 LTS. Taking someone out of a group that they no longer need is a simple way to keep the machine secure, because each person then touches only the files and settings their job requires. You need an account with sudo rights to make these changes.

Removing users from a group in Ubuntu Linux

Removing a user from a group takes one terminal command. The short version looks like this:

1. Open the terminal. On most Ubuntu desktops you can press Ctrl+Alt+T.
2. Type sudo deluser username groupname, replacing username with the real account name and groupname with the real group name.
3. Press Enter and type your own password if sudo asks for it. You will not see characters as you type. That is normal.
4. Read the output. If it worked, you should see a message saying the user was removed from the group.

The access tied to that group, such as shared files or admin rights, is revoked for the user from their next login. The command removes the user from the group only. It does not delete the user account or the group.

When you drop an account from a group, it loses whatever the group allowed. If a folder is shared with a group called developers, for example, a removed user can no longer open or change it through that group.

Removing a user from ‘sudo’ revokes their administrator privileges, so they can no longer run commands with sudo. Before you do this, make sure at least one other administrator account stays on the machine, and think twice before removing your own account. Otherwise you could lock yourself out of admin tasks.

The command format to remove a user from a group looks like this:

sudo deluser username groupname

The deluser command is a script that manages users and groups. It works with usermod, a utility for modifying user accounts, which also handles group memberships. For everyday use, deluser is the easier of the two to remember, because you give it the user and the group and it does the rest.

You can also remove a user from a group with gpasswd. The command sudo gpasswd -d geekrewind developers targets the user named geekrewind and removes them from the developers group. Here is how to run it:

1. Open the terminal.
2. Type sudo gpasswd -d geekrewind developers, changing the user and group names to match your system.
3. Press Enter and enter your password if asked. The terminal should print a line saying the user was removed from the group.

This does the job directly, without needing deep knowledge of other system settings. If the user is not in that group, or the group does not exist, you get an error message instead. Check the spelling of both names and try again.

sudo deluser geekrewind developers

Every user account belongs to one primary group, which is usually named after the user. A user can be a member of many other groups, but the primary group is the one new files are assigned to by default. Because every account must have a primary group, you cannot simply remove a user from it with the commands above. You have to assign a new primary group first.

Use the commands below to assign geekrewind to the developers group as its primary group.

For example, use the commands below to change the primary group for the user geekrewind to developers.

sudo usermod -g developers geekrewind

This action moves the geekrewind user from its current primary group to the developers group. The change is stored right away, but, as with other group changes, the user should log out and back in before it applies to their session.

With a new primary group in place, you can now remove the account from its previous primary group using the removal command from earlier. Without the new primary group, the system would refuse, because an account cannot be left without one.

To check which groups a user belongs to, use the command below. Run it after any change to confirm the result:

groups username

The output lists every group the user is in. The group you removed should no longer appear. If it is still there, check that you typed the user and group names correctly and that you ran the command with sudo. To undo a removal, add the user back to the group with an administrator account.

Conclusion:

• Groups in Ubuntu Linux help administrators efficiently organize and manage user accounts’ access to resources
• The format to remove a user from a group is “sudo deluser username groupname”. The “sudo gpasswd -d username groupname” command does the same job
• The deluser command is a script that works with the usermod utility to manage group membership. Removing a user from a group does not delete the account
• It’s important to note that a user account must be a member of one primary group
• You can change the primary group of a user account using the usermod command
• You can verify a user’s groups by running the “groups username” command. Ask the user to log out and back in so the change takes effect