We are getting ready to migrate to Active Directory-based Samba, from the old style domain. Currently all our groups are flat - users belong to groups, but groups can't belong to other groups. Since I want to change that, I need to list all the groups with users.

The catch is that there are thousands of users, and thousands of groups. What I need is to list the groups with 2 or more members, then only show the group name on the command line. This should eliminate user-groups, or groups with only one user.

How can I do this in Debian?

  • @Jesse_b : I’m just saying, whatever input file you pictured in mind when you posted your awk answer, I just asked the OP to post a snippet of it, or Atleast mention the file is /etc/group.
    – Inian
    Commented Mar 20, 2018 at 16:54
  • You probably want to make sure that only groups with a GID between [GID_MIN, GID_MAX] (from /etc/login.defs, usually 1000-60000) are processed: the other groups are admin, system or daemon groups and you probably don't want to mess with those.
    – ErikF
    Commented Mar 20, 2018 at 20:19

3 Answers 3



getent group | awk -F ':' '$4 ~ "," {print $1}'

If the 4th colon-delimited field (user list) of the group list contains a comma, then print the first colon-delimited field (group name).


Probably not the best way to do it, but this might work:

awk -F: '$NF ~ "," { print $1 }' /etc/group

as group members are comma-delimited, only multi-member groups will have commas. From these group-file lines, show only the line content before the first colon.

grep , /etc/group | cut -d: -f 1
  • What if the groups are stored in NIS or LDAP?
    – Jeff Schaller
    Commented Mar 20, 2018 at 22:32
  • depends on what data is in there, the schema used, etc.
    – jmullee
    Commented Mar 20, 2018 at 23:46
  • My point being that not everyone stores their group data in /etc/group
    – Jeff Schaller
    Commented Mar 20, 2018 at 23:47
  • indeed, maybe a new question like 'how to extract group daya from system X with schema Y using tool Z' would be useful
    – jmullee
    Commented Mar 20, 2018 at 23:59
  • I'm sorry again, I really wasn't clear with my first comment. I was saying that searching /etc/group is a common first step, but that group information may also be elsewhere. Using getent is a way to gather information from any & all repositories that are configured (including local files, LDAP, NIS, etc).
    – Jeff Schaller
    Commented Mar 21, 2018 at 0:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .