By CMD Script Team · 3 min read · Last updated
On this page
groups [USER][X]- Optional — the command works without it
X...- Repeatable — you can pass more than one
ALLCAPS- A placeholder — replace it with your own value
Options
| Flag | Description |
|---|---|
USER | Show memberships for one named user instead of the current user |
Distribution compatibility
- Ubuntu
- Debian
- Fedora
- Arch
- macOS
What it does
groups lists the current user's effective and supplementary groups. When you provide
a user name, it looks up the groups recorded for that user instead. It is an inspection
command: it does not add users to groups or otherwise change membership.
Named-user results can differ from the groups active in an existing login session that
has not been refreshed after a membership change. Group information can also come
through the Name Service Switch (NSS), including directory services, rather than only
from /etc/group.
Beginner examples
groups— list the groups active for the current user.groups alice— inspect the recorded group memberships foralice.groups alice bob— inspect two named users using the GNU/coreutils extension.groups "$USER"— look up the current account by its user name.
groups
Advanced examples
- Prefer
id -nG alicewhen a script needs the group names for a named user;idhas clearer scripting-oriented output and other selectors for numeric IDs. - Compare
groupswithid -gnto distinguish the effective group from the complete group list in the current session. - Query
getent group developerswhen you need the membership entry for one group, including groups supplied through NSS.
id -nG alice
Do not parse either command by naive whitespace splitting. Although uncommon, group names can contain spaces on systems whose account database permits them.
GNU coreutils accepts multiple user operands in one invocation. macOS accepts one
optional user, so invoke groups separately or loop when checking multiple accounts.
Try it yourself
A simulated shell with a sample home directory — experiment freely, nothing leaves your browser. Type help to list supported commands.
Common mistakes
- Expecting
groupsto add or remove memberships. It only reports information. - Assuming a newly granted supplementary group appears in an already-running shell. Usually the user must start a fresh login session first.
- Treating
/etc/groupas the complete source of truth when NSS may resolve groups from LDAP, NIS, or another directory service. - Splitting output on spaces in automation and silently misreading a group name that itself contains a space.
Tips
- Run both
groupsandidwhile troubleshooting so you can see names, numeric IDs, and the effective group. - Quote shell variables in user lookups:
groups "$USER". - Use
getent group GROUPto inspect a specific group through the same NSS lookup system used by many account tools.
Best practices
- Use
groupsfor quick interactive inspection andid -nG USERin scripts. - Refresh the login session before concluding that a recent membership change failed.
- Avoid depending on output order; verify the particular group you require.
- Treat group membership as authorization information and expose it only where needed.
Real-world use cases
- Confirming whether the current shell has access to a shared project directory.
- Checking a user's supplementary memberships while diagnosing a permission error.
- Comparing two accounts before assigning access to a service or deployment resource.
- Verifying that an NSS-backed directory group resolves on a particular host.
Common interview questions
- What does
groupsshow with no arguments? The effective and supplementary groups active for the current user. - Why might a recent group addition be missing? Supplementary memberships are often established when a login session starts, so the existing session may be stale.
- Does
groupsread only/etc/group? No. NSS can supply group data from local files, LDAP, NIS, and other configured sources. - What should automation use? Prefer
id -nG USER, while still avoiding naive whitespace parsing where group names with spaces are possible.
Frequently Asked Questions
Why does groups not show a group I was just added to?
Your current session may still have its old supplementary group list. Sign out and back in, or start an appropriate new session, to refresh it.
Does groups change group membership?
No. It only inspects membership; use an administrative tool such as gpasswd or usermod to make changes.
Why can groups show memberships that are not in /etc/group?
Group lookups use the Name Service Switch, so results may come from LDAP, NIS, or another configured directory service.
Should scripts parse groups output?
Prefer id -nG USER for scripts, and do not split output naively on whitespace because valid group names may contain spaces on some systems.
Cheat sheet
Download a quick-reference cheat sheet for groups.