usermod Command in Linux: Modify User Accounts and Groups

The usermod command in Linux modifies existing user account attributes. You can use it to manage group membership, change the home directory or login shell, rename a user, set an expiry date, and lock or unlock an account.

Only root or users with sudo access can run usermod. To create new users, use useradd. To remove them, use userdel.

How the usermod Command Works in Linux

The syntax is:

bashusermod [OPTIONS] USER

The command produces no output on success.

Adding a user to a secondary group is the most common use. Always include -a (append) alongside -G:

bashsudo usermod -a -G games linuxize

Without -a, the -G option replaces the user’s entire supplementary group list. Every group not listed is silently removed — this can revoke access to shared directories and services without any warning. To add to multiple groups at once, use a comma-separated list with no spaces:

bashsudo usermod -a -G games,sudo,docker linuxize

Verify group membership after the change:

bashid linuxize

Group changes take effect on the next login. Active sessions do not pick up new groups automatically.

Change the primary group with -g. Each user has exactly one primary group, which is applied to newly created files by default:

bashsudo usermod -g developers linuxize

Update the GECOS field (the user’s full name or description) with -c. This is stored in /etc/passwd:

bashsudo usermod -c "Test User" linuxize

Manage Home Directory, Shell, and UID

Change the home directory with -d. By default, the old directory’s contents are not moved:

bashsudo usermod -d /var/www www-data

To move the contents to the new location, add -m. The new directory is created automatically if it does not exist:

bashsudo usermod -d /var/www -m www-data

Change the login shell with -s. The full path to the shell binary is required:

bashsudo usermod -s /usr/bin/zsh linuxize

Available shells are listed in /etc/shells. Always verify the path exists before changing it — setting a path that does not exist prevents the user from logging in.

Change the UID with -u. The kernel uses the UID internally to identify the user, independent of the username:

bashsudo usermod -u 1050 linuxize

Files in the user’s home directory and mailbox are updated automatically. Files owned by the user in other locations must be changed manually with chown. For service accounts, this matters because configuration files, logs, and data directories are often outside the home directory.

Rename, Set Expiry, and Lock or Unlock Accounts

Rename a user with -l. The new username comes first, followed by the current one:

bashsudo usermod -l leah linuxize

Renaming does not touch the home directory. Update it in the same command with -d and -m:

bashsudo usermod -l leah -d /home/leah -m linuxize

Any cron jobs or scripts that reference the old username must be updated separately.

Set an expiry date with -e in YYYY-MM-DD format. The account is disabled on that date:

bashsudo usermod -e "2026-12-31" linuxize

To remove the expiry and keep the account active indefinitely, pass an empty string:

bashsudo usermod -e "" linuxize

Confirm the expiry date with chage -l. The expiry value is stored in /etc/shadow.

Lock an account with -L. This inserts an exclamation point before the encrypted password hash in /etc/shadow, blocking password-based logins. SSH key authentication and su still work because they bypass the password hash entirely:

bashsudo usermod -L linuxize

To disable all login methods, combine -L with an expiry date of 1:

bashsudo usermod -L -e 1 linuxize

Unlock an account with -U:

bashsudo usermod -U linuxize

Run id USERNAME after group changes and sudo chage -l USERNAME after expiry changes to confirm the result. Leave a comment below if you run into any issues.