Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 6 down vote favorite
1

How can an administrator find the UID of a user that's been deleted with the userdel command?

share|improve this question
Is the account already deleted? – Michael Mrozek♦ May 14 '12 at 15:56
@ Michael Mrozek yes. – XinHua May 14 '12 at 16:06
Is the home directory still around? An "ls -l" of that directory should show the UID, given that the entry from /etc/passwd is gone. – cjc May 14 '12 at 16:11
@cjc no! Home directory is deleted and the admin doesn't now which file belongs to that account. – XinHua May 14 '12 at 16:15

2 Answers

up vote 12 down vote accepted

By looking at /etc/passwd in the backups taken of your system from the day/week/period before the user deletion.

If userdel was used with -r, then both the home directory and user's mail spool have gone. If it wasn't used with -r, check for the user's mail spool, or perhaps a crontab if you're very lucky.

If there are no backups, and no obvious files owned by that user you can check, then you'll need to scout around places like /tmp and look for files with UID's as owners and try and work it out - but really, your backup is your best bet.

Edit: as jw013 points out you could also use find / -nouser to find files which have no matching user for the file's UID.

share|improve this answer
2  
You can try: find / -uid <UID> to find all files owned by the user. -uid is an option on GNU find at least. – donothingsuccessfully May 14 '12 at 17:31
12  
Actually, GNU find has the -nouser test for this purpose - it tests true for files whose uid does not correspond to any user on the system. – jw013 May 14 '12 at 18:32
4  
@jw013 this approach works only if you have deleted only one user from system but if you have a system with 300 users that worked for 5 years with tens of deleted users you can't use this method at all. – XinHua May 16 '12 at 6:40
2  
This is an example that only describes a situation in which your suggestion doesn't work nothing more. – XinHua May 16 '12 at 14:03
2  
Well, -nouser in combination with -mtime would let you find out the most recently active unowned files, which would probably help. – EightBitTony May 16 '12 at 20:07
show 3 more comments
up vote 1 down vote

If there are 10 users and 1 deleted user, you could check /etc/passwd for which UID from 1000 and up is missing.

share|improve this answer
1  
Not 100% reliable, particularly if more than one account has been deleted, but likely to be quick if it works. – Keith Thompson May 15 '12 at 20:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.