How to List Groups in Linux and Check User Group Membership

Linux groups control file permissions, sudo access, and shared resources such as the docker socket. You often need to list every group on the system, see which groups a user belongs to, or list members of one group such as sudo or wheel.

The commands below use getent, groups, and id — the same tools covered in the GNU id manual and NSS getent manual. For adding users to groups, see add user to group in Linux; for listing accounts, see list users in Linux.

Quick reference

List all groups on the system

Use getent (preferred)

getent group queries every group source configured in NSS (local files, systemd, SSSD, LDAP). Use it when you want the complete list, not only what is stored in /etc/group.

getent group

Sample output (trimmed):

root:x:0:
daemon:x:1:
adm:x:4:syslog,golinuxcloud
sudo:x:27:golinuxcloud
docker:x:123:
golinuxcloud:x:1000:

Each line is name:password_placeholder:GID:members. An empty fourth field means no supplementary members are listed for that group.

To count how many groups NSS returns on this host:

getent group | wc -l

83

Read /etc/group (local only)

cat /etc/group reads the local group file directly. It is faster to skim but can miss directory-backed groups that getent would still show.

cat /etc/group

On a laptop with only local accounts, output usually matches getent group. On domain-joined hosts, getent often shows more.

Print group names only

When you only need names (for scripts or a quick checklist), print the first field:

getent group | cut -d: -f1

Or with awk:

getent group | awk -F: '{print $1}'

Both commands drop the GID and member list, leaving one group name per line.

Sort by GID or filter system groups

To audit GIDs or separate system groups from user-created groups, sort or filter on the third field:

Sort numerically by GID:

getent group | sort -t: -k3 -n

List groups with GID below 1000 (typical system groups on many distributions):

getent group | awk -F: '$3 < 1000 {print $1":"$3}'

Sample:

root:0
daemon:1
sudo:27

The name:GID format makes it easy to spot gaps or duplicate IDs.

List groups from Bash completion

Bash can tab-complete group names from its own list. This is a shell helper, not the system group database:

compgen -g

This lists groups known to the shell; it is handy interactively but not a substitute for getent in scripts.

Check groups for a user

To see what groups an account belongs to, start with groups for a short name list or id when you also need numeric IDs.

groups — quick name list

groups prints the username followed by every group name (primary and supplementary). Omit the username to check the current shell user.

Current user:

groups

Another user:

groups golinuxcloud

golinuxcloud : golinuxcloud adm cdrom sudo dip plugdev users lpadmin

In this example, golinuxcloud is the primary group. To confirm the primary group reliably, use id -gn username.

id — UID, primary GID, and every group

id shows the user ID, primary group ID, and every group ID with names in parentheses when available.

id golinuxcloud

uid=1000(golinuxcloud) gid=1000(golinuxcloud) groups=1000(golinuxcloud),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users),115(lpadmin)

Here gid is the primary group. The groups= list includes primary and supplementary memberships.

Useful id flags when you want a narrower view:

Examples:

id -Gn golinuxcloud
id -g golinuxcloud

golinuxcloud adm cdrom sudo dip plugdev users lpadmin
1000

-g returns only the primary GID. Use full id username when you need both numeric IDs and names in one line.

Check if a user belongs to a specific group

To check whether a user belongs to a group:

id -nG username | tr ' ' '\n' | grep -x groupname

Example:

id -nG listgroups_demo | tr ' ' '\n' | grep -x docker

docker

If the command prints docker, the user is a member of that group. If it prints nothing, the user is not a member or the group is not visible through NSS.

The same pattern works for sudo, wheel, docker, or any other group name returned by id -nG.

List users in a specific group

getent group groupname is the usual starting point — the same approach recommended on Ask Ubuntu and Unix & Linux Stack Exchange for high-traffic “list members of a group” questions.

getent group sudo

sudo:x:27:golinuxcloud

The line reads sudo group, GID 27, with golinuxcloud as a supplementary member. The fourth field lists supplementary members only.

To print just the usernames in that field:

getent group sudo | cut -d: -f4

golinuxcloud

Or grep the local file when you only care about /etc/group:

grep '^sudo:' /etc/group

List all users in a group, including primary members

getent group groupname shows only users listed as supplementary members in /etc/group. It does not show users whose primary group is that group (primary GID is stored in /etc/passwd, field 4).

To include both supplementary and primary members:

groupname="sudo"
gid=$(getent group "$groupname" | cut -d: -f3)

echo "Supplementary members:"
getent group "$groupname" | cut -d: -f4 | tr ',' '\n'

echo "Primary members:"
getent passwd | awk -F: -v gid="$gid" '$4 == gid {print $1}'

On our test host:

Supplementary members:
golinuxcloud
Primary members:

No account uses sudo as a primary group here — only supplementary membership appears. For a group that is commonly a primary group, try the same script with groupname="golinuxcloud":

Supplementary members:

Primary members:
golinuxcloud

To print one combined list without blank lines or duplicates:

groupname="sudo"
gid=$(getent group "$groupname" | cut -d: -f3)

{
  getent group "$groupname" | cut -d: -f4 | tr ',' '\n'
  getent passwd | awk -F: -v gid="$gid" '$4 == gid {print $1}'
} | sed '/^$/d' | sort -u

For sudo on our test host, that prints golinuxcloud.

For most admin checks on one account, id username is still the safest way to confirm every group that user belongs to.

Administrative groups — sudo vs wheel

Privileged access is granted through different default group names depending on the distribution. List the relevant admin group to see who has supplementary membership in that group:

Review both on migrated or mixed environments.

Primary vs supplementary groups

Every user has one primary group (default owner for new files) and zero or more supplementary groups (extra permissions).

Primary GID from passwd (field 4 is the numeric primary group):

getent passwd golinuxcloud | cut -d: -f1,4

golinuxcloud:1000

Here 1000 matches the golinuxcloud group GID — that is this user's primary group.

Supplementary membership appears in /etc/group member fields and in id output. For example, golinuxcloud is also in sudo:

getent group sudo

sudo:x:27:golinuxcloud

That is why getent group sudo alone is incomplete when you need every account tied to that GID — combine it with the getent passwd awk pattern above.

To change membership, use usermod or groupadd workflows from add user to group. After usermod -aG, the user must log out and back in (or run newgrp groupname) before groups shows the new list in an existing shell.

How /etc/group and NSS work

Each line in /etc/group has four colon-separated fields:

group_name:password_placeholder:GID:member_list

Example:

sudo:x:27:golinuxcloud

The primary group for a user is stored in the fourth field of /etc/passwd, not in the member list of /etc/group. That is why grep username /etc/group can miss a group the user still belongs to.

Linux resolves groups through the Name Service Switch (NSS). Check your configuration:

grep '^group:' /etc/nsswitch.conf

On our test host:

group:          files systemd sss

getent group reads this stack — local files, then systemd, then sss (SSSD) when configured — so it is the reliable way to list groups on LDAP or Active Directory-backed systems, not only cat /etc/group.

Look up group name from GID (and reverse)

getent group accepts either a group name or a numeric GID, which is useful in scripts and log files that only show numbers.

Resolve a GID from a group name (third field):

getent group sudo | cut -d: -f3

27

Look up the full record when you have a GID from ls -n, logs, or id -G:

getent group 27

sudo:x:27:golinuxcloud

Print only the group name from that GID:

getent group 27 | cut -d: -f1

sudo

Groups from LDAP, SSSD, or FreeIPA

When nsswitch.conf lists ldap, sss, or similar after files, getent group returns directory groups alongside local entries. If cat /etc/group looks incomplete but getent group shows expected names, NSS is doing its job.

If directory groups are missing:

1. Confirm group: line in /etc/nsswitch.conf.
2. Check SSSD or LDAP client services (systemctl status sssd on many setups).
3. Test NSS with getent group known_directory_group.

Do not edit /etc/group by hand to mirror LDAP membership — manage groups in the directory or with add user to group on the local system when appropriate.

Troubleshooting

References

• getent(1) — get entries from administrative database
• group(5) — user group file
• passwd(5) — user account information
• groups(1) — print group names a user belongs to
• id(1) — print user and group IDs
• nsswitch.conf(5) — Name Service Switch configuration

Summary

Use getent group to list all groups, groups or id -Gn to see what groups a user belongs to, and getent group groupname for supplementary members. When forum-style questions ask for every user in a group, add getent passwd with awk on the primary GID field — getent group alone misses primary members. Prefer getent over cat /etc/group when LDAP or SSSD is in play.