| Tested on | Red Hat Enterprise Linux 10.2 (Coughlan) |
|---|---|
| Package | shadow-utils 4.15.0-11.el10 (usermod, gpasswd, useradd) |
| Applies to | Ubuntu, Debian, Kali Linux, Linux Mint, Pop!_OS, Raspberry Pi OS, RHEL, Rocky Linux, AlmaLinux, Oracle Linux, CentOS Stream, Fedora |
| Privilege | sudo or root |
| Scope | Add an existing local user to a primary or supplementary group, verify membership, and apply the change in an active session. |
| Related guides | usermod command groupadd command adduser command list groups in Linux remove user from group |
To add an existing user to a supplementary group, run sudo usermod -aG groupname username. That is the command most admins need. The sections below cover verification, Debian shortcuts, changing the primary group, and what to do when a session still behaves like the old membership.
Quick reference
| Task | Command |
|---|---|
| Add user to a supplementary group | sudo usermod -aG groupname username |
| Add user to multiple groups | sudo usermod -aG group1,group2 username |
| Debian/Ubuntu shortcut | sudo adduser username groupname |
| Alternate append syntax | sudo gpasswd -a username groupname |
| Change primary group | sudo usermod -g groupname username |
| Verify all groups | id username |
| Group names only | groups username |
| List members of one group | getent group groupname |
| Apply group in current shell | newgrp groupname |
| Create a group first | sudo groupadd groupname |
Primary group vs supplementary group
Every user has one primary group. New files normally use the process's effective group as their group owner. A setgid directory can instead make new files inherit the directory's group. Commands such as newgrp can change the effective group for a shell, while chgrp changes the group ownership of existing files.
- Primary group: stored in field 4 of
/etc/passwd; shown asgid=inidoutput. - Supplementary groups: additional group memberships shown by
id; local supplementary members are typically recorded in the fourth field of/etc/group, while NSS sources such as LDAP or SSSD may provide memberships externally.
Most day-to-day access control uses supplementary groups (docker, sudo, wheel, project groups). Use usermod -aG for those. Use usermod -g only when you want to change the user's primary group.
Add a user to a supplementary group
usermod with -a (append) and -G (supplementary groups) is the portable choice on RHEL, Fedora, and most other distributions.
First confirm the account and target group exist:
id glc_useruid=1014(glc_user) gid=1015(glc_user) groups=1015(glc_user)Next, confirm the target group exists and has no members yet:
getent group glc_demoglc_demo:x:1014:glc_user exists and glc_demo is an empty group, so append the user to it:
sudo usermod -aG glc_demo glc_userusermod prints nothing on success. Check the account again:
id glc_useruid=1014(glc_user) gid=1015(glc_user) groups=1015(glc_user),1014(glc_demo)The numeric GID 1014 beside glc_demo confirms the supplementary membership is stored. getent group glc_demo should now list glc_user in the fourth field.
-G with -a when adding a group. sudo usermod -G groupname username without -a replaces every supplementary group with the list you pass, which can silently remove sudo, wheel, or docker access.
For flag-by-flag usermod coverage, see the usermod command cheat sheet.
Add a user to multiple groups
List every supplementary group in one -G argument, separated by commas with no spaces:
sudo usermod -aG docker,glc_demo,glc_web glc_userConfirm the full set:
groups glc_userglc_user : glc_user glc_demo glc_web dockerIf any name is misspelled or missing, usermod reports an error. Every group in the list must already exist, so verify names with getent group groupname before running the command.
Debian and Ubuntu: adduser shortcut
On Debian and Ubuntu, adduser username groupname is the distribution-provided high-level command for adding an existing user to an existing group:
sudo adduser glc_user glc_demoThe result is the same supplementary membership you would create with usermod -aG. On RHEL-family systems, stick with usermod or gpasswd. See the adduser command cheat sheet for create-user workflows.
Add an existing user to a group with gpasswd
gpasswd -a appends one user to one group and is equivalent to usermod -aG for a single pair:
sudo gpasswd -a glc_user glc_demo2Adding user glc_user to group glc_demo2The fourth field of /etc/group should now list the account:
getent group glc_demo2glc_demo2:x:1016:glc_userTo remove a membership later, use gpasswd -d — covered in remove user from group in Linux.
Change a user's primary group
Changing the primary group affects ownership of new files, not just shared directory ACLs:
sudo usermod -g glc_demo glc_userAfter that, id -gn glc_user reports glc_demo as the primary group name. Existing files keep their old group until you change them with chgrp.
Verify group membership
| Goal | Command |
|---|---|
| UID, primary GID, every group | id username |
| Group names only | groups username |
| Primary group name | id -gn username |
| Who belongs to one group | getent group groupname |
On hosts with LDAP or SSSD, prefer getent over grep /etc/group so you see directory-backed groups. The list groups in Linux guide walks through getent, id, and /etc/group in more detail.
Apply the new group in an active session
Group changes apply to new login sessions. A shell that was already open still has the old group list.
id glc_user may already show the newly stored membership, while an existing shell belonging to glc_user still has the old group credentials. Run plain id inside that user's existing shell to see the groups available to that running session. GNU id reports the named account when you pass a username; without one, it reports the current process.
Ask the user to log out and back in, or start a fresh login shell:
su - glc_userTo test one supplementary group without a full logout:
newgrp glc_demonewgrp starts a subshell with glc_demo as an active group. Run id inside that subshell to confirm before testing file or sudo access.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
usermod: group 'name' does not exist |
Group not created or typo | Run getent group name; create with sudo groupadd name if missing |
| User lost other group access | usermod -G without -a |
Re-add every required group with sudo usermod -aG group1,group2 username |
id shows the group but permission denied |
Stale shell session | Log out and in, su - username, or newgrp groupname |
adduser: user 'x' is already a member of group 'y' |
Already a member | No action needed; verify with groups username |
Member missing from getent group but id shows it |
NSS/cache delay on directory systems | Retry after SSSD sync; compare getent passwd and getent group |
References
Summary
Adding an existing Linux user to a supplementary group comes down to sudo usermod -aG groupname username, then confirming with id or groups. The -a flag is not optional when you use -G; without it, you replace the user's entire supplementary list and can lock them out of sudo, wheel, or shared project groups.
On Debian and Ubuntu, sudo adduser username groupname is a readable shortcut for the same append operation. Use usermod -g only when you need to change the primary group that owns new files, and use gpasswd -a when you prefer the group-management syntax.
Membership is stored immediately, but running shells keep their existing group credentials. Start a new login session to load the complete updated group list, or use newgrp groupname when you only need to activate one newly added group in the current terminal. For deeper usermod options, group creation, and removal workflows, use the linked cheat sheets and the remove user from group guide.
