6

How can an administrator find the UID of a user that's been deleted with the userdel command?

Improve this question
4
  • Is the account already deleted?
    – Michael Mrozek
    May 14, 2012 at 15:56
  • @ Michael Mrozek yes.
    – Sam
    May 14, 2012 at 16:06
  • Is the home directory still around? An "ls -l" of that directory should show the UID, given that the entry from /etc/passwd is gone.
    – cjc
    May 14, 2012 at 16:11
  • @cjc no! Home directory is deleted and the admin doesn't now which file belongs to that account.
    – Sam
    May 14, 2012 at 16:15

2 Answers 2

Reset to default
12

By looking at /etc/passwd in the backups taken of your system from the day/week/period before the user deletion.

If userdel was used with -r, then both the home directory and user's mail spool have gone. If it wasn't used with -r, check for the user's mail spool, or perhaps a crontab if you're very lucky.

If there are no backups, and no obvious files owned by that user you can check, then you'll need to scout around places like /tmp and look for files with UID's as owners and try and work it out - but really, your backup is your best bet.

Edit: as jw013 points out you could also use find / -nouser to find files which have no matching user for the file's UID.

Improve this answer
8
  • 2
    You can try: find / -uid <UID> to find all files owned by the user. -uid is an option on GNU find at least.
    – donothingsuccessfully
    May 14, 2012 at 17:31
  • 12
    Actually, GNU find has the -nouser test for this purpose - it tests true for files whose uid does not correspond to any user on the system.
    – jw013
    May 14, 2012 at 18:32
  • 4
    @jw013 this approach works only if you have deleted only one user from system but if you have a system with 300 users that worked for 5 years with tens of deleted users you can't use this method at all.
    – Sam
    May 16, 2012 at 6:40
  • 2
    This is an example that only describes a situation in which your suggestion doesn't work nothing more.
    – Sam
    May 16, 2012 at 14:03
  • 2
    Well, -nouser in combination with -mtime would let you find out the most recently active unowned files, which would probably help.
    – EightBitTony
    May 16, 2012 at 20:07
1

If there are 10 users and 1 deleted user, you could check /etc/passwd for which UID from 1000 and up is missing.

Improve this answer
1
  • 1
    Not 100% reliable, particularly if more than one account has been deleted, but likely to be quick if it works.
    – Keith Thompson
    May 15, 2012 at 20:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .