How to remove a user from a group in Linux

Group membership can leave a Linux account with file, device, or service access after a project role or temporary support task ends. Removing only the obsolete supplementary group closes that access without deleting the account or changing the groups the user still needs.

Linux keeps a primary group for default ownership and supplementary groups for additional access. The id command shows the primary group as gid= and the full group set as groups=, while gpasswd removes a named supplementary membership from the local group database.

Changing group membership affects new sessions, not shells or services that already started with the old credentials. Directory-managed accounts such as LDAP or Active Directory users should be changed in the directory source, and privileged groups such as sudo or wheel need a separate recovery path before removal.

Steps to remove a Linux user from a supplementary group:

Confirm that the target account resolves on the system.
```
$ getent passwd audituser
audituser:x:1001:1003:Audit User:/home/audituser:/bin/sh
```
Replace audituser with the login whose group access needs to be reduced.
Inspect the account's current group assignments.
```
$ id audituser
uid=1001(audituser) gid=1003(audituser) groups=1003(audituser),1001(finance),1002(deploy)
```
The gid= value is the primary group. Use gpasswd for supplementary memberships such as deploy; changing the primary group with usermod --gid is a separate default-ownership change.
Remove the obsolete supplementary membership.
```
$ sudo gpasswd --delete audituser deploy
Removing user audituser from group deploy
```
Removing sudo, wheel, adm, or a service-owned group can block future administrative or application access. Keep another administrator session or console path available before removing privileged membership.
Confirm the removed group is absent from the account database.
```
$ groups audituser
audituser : audituser finance
```
When usermod supports --remove, sudo usermod --remove --groups deploy audituser removes a named supplementary group too. Older usermod --groups examples without --remove replace the entire supplementary group list.
Start a fresh login shell for the account and verify the active group set.
```
$ sudo -iu audituser id -nG
audituser finance
```
Ask the user to reopen terminals, SSH sessions, desktop sessions, or affected services before retesting access that depends on group membership.

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.