groupdel Command in Linux: Remove a Group and Audit Files

The groupdel command in Linux removes a group from the system. It deletes the group’s entry from /etc/group and /etc/gshadow, but does not delete or modify any files owned by that group.

Only root or a user with sudo privileges can run groupdel.

How the groupdel Command Works in Linux

The syntax is:

bashgroupdel GROUPNAME

The command produces no output on success. Verify the deletion with getent:

bashgetent group mygroup

No output means the group is gone. Use groupadd to create a new group, or usermod -g to change a user’s primary group before deleting one.

Check Primary Group and Members Before Deleting

groupdel refuses to delete a group if it is the primary group of any existing user. Supplementary group members do not block deletion, but removing them first avoids stale group references.

Check for primary group users. First, get the group’s GID:

bashgetent group mygroup

mygroup:x:1005:

The third field is the GID. The fourth field lists supplementary members only — users who have this group as their primary group are NOT shown here. To find them, match the GID against the fourth field of /etc/passwd:

bashawk -F: '$4 == 1005 {print $1}' /etc/passwd

If any users are returned, change their primary group before proceeding:

bashsudo usermod -g newgroup username

Remove supplementary members. Use gpasswd -d to remove users from the group before deleting it:

bashsudo gpasswd -d username mygroup

Delete the Group and Handle Orphaned File Ownership

Once the primary group check passes, delete the group:

bashsudo groupdel mygroup

Files owned by the deleted group are not deleted. They retain the numeric GID. When listed, the GID appears as a number instead of a name:

-rw-r--r-- 1 linuxize 1005 1024 Mar 01 10:00 file.txt

This is a security risk. If a new group is later created and assigned the same GID (1005), those files will appear owned by the new group, granting its members access they were never intended to have. GID reuse makes orphaned files a real issue on systems where groups are created and removed regularly.

After any group deletion, audit for orphaned files using the old GID:

bashsudo find / -gid 1005

On large systems, scanning from / takes time. If you know where the group’s files were located, limit the search to /home, /srv, or a specific directory:

bashsudo find /home -gid 1005

Reassign ownership as needed:

bashsudo chown :newgroup /path/to/file

The colon before the group name tells chown to change only the group ownership, leaving the file owner unchanged.

Before running groupdel, check for primary group users with awk -F: '$4 == GID' against /etc/passwd. After deletion, run find / -gid GID to locate and reassign any orphaned files before the GID gets reused. Leave a comment below if you run into any issues.