Remove a Supplementary Membership

The assistant no longer needs the reports team's supplementary role. Removing that membership narrows the account's configured group list without deleting the entire account. We will use gpasswd -d for the specific membership.

There is a timing detail that matters in practice: changing the group database does not rewrite every running process's credentials. A person can have an old session whose group list differs from the current account record. Understanding that distinction prevents a misleading 'the command did nothing' conclusion.

Prepare the example

Use the practice VM, an existing account and a supplementary group membership you intend to remove. Check the current relationship first. This example concerns supplementary membership; changing an account's primary group is a different operation.

Bash · Linux terminal

sudo gpasswd -d school-assistant school-reports
id school-assistant

Expected behavior; machine-dependent details

Configured supplementary membership changes; current process credentials may remain.

gpasswd -d school-assistant school-reports removes the named member from that group under the tool's rules. The account name comes first and the group second. id school-assistant then helps inspect the configured membership after the change.

If the assistant is already logged in, that running shell may retain earlier group credentials. A fresh appropriate session will reflect the current configuration. If immediate revocation is required, consider the old sessions and processes as part of the plan; editing one database entry is not a universal session-termination command.

Removing a supplementary group membership is useful when a user no longer needs access granted through that group. The safest approach is to remove only the one membership you intend to change.

Why would you remove a user from a group?

Groups in Linux help manage permissions. If a user no longer needs access to a specific resource—like a shared folder or service—you should remove them from the group that controls it.

Step 1: Check the groups a user belongs to

Before removing a user from a group, it's a good idea to check what groups they are currently in.

groups username

For example, to check groups for user john:

groups john

john : john sudo docker developers

This tells us that john is part of the sudo, docker, and developers groups.

Step 2: Remove user from a group

You can use one of the following commands. Let's go over each.

Option 1: Using gpasswd

This is the cleanest way to remove a user from a group.

sudo gpasswd -d john developers

Removing user john from group developers

Option 2: Using deluser (Debian/Ubuntu only)

This works similarly but is available only on Debian-based systems:

sudo deluser john developers

Removing user `john` from group `developers` ...
Done.

Option 3: Using usermod to redefine group membership

This method replaces the user's entire list of supplementary groups, so use it carefully!

sudo usermod -G sudo,docker john

This command reassigns john to just the sudo and docker groups, effectively removing him from developers.

Step 3: Verify the user was removed from the group

groups john

john : john sudo docker

Great! Now the user is no longer part of the developers group.

Verify group membership after removal

Group membership changes take effect immediately for new terminal sessions. If the user is currently logged in, they may need to log out and back in to see the changes.

Remove only the intended group membership

And that’s it! You’ve successfully learned how to remove a user from a group in Linux. Whether you’re managing permissions for a small team or setting up secure environments, this is a key skill to have.

Your task: Can an already-running process retain its earlier group credentials?

Use the practice VM, an existing account and a supplementary group membership you intend to remove. Check the current relationship first. This example concerns supplementary membership; changing an account's primary group is a different operation.

Bash · complete example for this question

sudo gpasswd -d school-assistant school-reports
id school-assistant

Expected behavior; machine-dependent details

Configured supplementary membership changes; current process credentials may remain.

Worked answer

Yes; database edits do not rewrite every process credential.

Yes, an existing process can retain its earlier group credentials. Compare an account lookup with credentials inside the running session instead of treating those two observations as interchangeable. This is why testing a membership change may require a new session.

Remove the intended supplementary relationship rather than the person or the entire group. Verify the configured membership and account for existing processes when revocation timing matters. A database change and a live credential change are separate events.