How to remove a user from a group in Linux

Group membership can leave a Linux account with file, device, or service access after a project role or temporary support task ends. Removing only the obsolete supplementary group closes that access without deleting the account or changing the groups the user still needs.

Linux keeps a primary group for default ownership and supplementary groups for additional access. The id command shows the primary group as gid= and the full group set as groups=, while gpasswd removes a named supplementary membership from the local group database.

Changing group membership affects new sessions, not shells or services that already started with the old credentials. Directory-managed accounts such as LDAP or Active Directory users should be changed in the directory source, and privileged groups such as sudo or wheel need a separate recovery path before removal.

Related: How to add a user to a group in Linux
Related: How to audit local user accounts in Linux

Steps to remove a Linux user from a supplementary group:

  1. Confirm that the target account resolves on the system. 
    $ getent passwd audituser
audituser:x:1001:1003:Audit User:/home/audituser:/bin/sh

    Replace audituser with the login whose group access needs to be reduced.

  2. Inspect the account's current group assignments. 
    $ id audituser
uid=1001(audituser) gid=1003(audituser) groups=1003(audituser),1001(finance),1002(deploy)

    The gid= value is the primary group. Use gpasswd for supplementary memberships such as deploy; changing the primary group with usermod --gid is a separate default-ownership change.

  3. Remove the obsolete supplementary membership. 
    $ sudo gpasswd --delete audituser deploy
Removing user audituser from group deploy

    Removing sudo, wheel, adm, or a service-owned group can block future administrative or application access. Keep another administrator session or console path available before removing privileged membership.

  4. Confirm the removed group is absent from the account database. 
    $ groups audituser
audituser : audituser finance

    When usermod supports --remove, sudo usermod --remove --groups deploy audituser removes a named supplementary group too. Older usermod --groups examples without --remove replace the entire supplementary group list.

  5. Start a fresh login shell for the account and verify the active group set. 
    $ sudo -iu audituser id -nG
audituser finance

    Ask the user to reopen terminals, SSH sessions, desktop sessions, or affected services before retesting access that depends on group membership.