We are getting ready to migrate to Active Directory-based Samba, from the old style domain. Currently all our groups are flat - users belong to groups, but groups can't belong to other groups. Since I want to change that, I need to list all the groups with users.

The catch is that there are thousands of users, and thousands of groups. What I need is to list the groups with 2 or more members, then only show the group name on the command line. This should eliminate user-groups, or groups with only one user.

How can I do this in Debian?

  • @Jesse_b : I’m just saying, whatever input file you pictured in mind when you posted your awk answer, I just asked the OP to post a snippet of it, or Atleast mention the file is /etc/group. – Inian Mar 20 '18 at 16:54
  • You probably want to make sure that only groups with a GID between [GID_MIN, GID_MAX] (from /etc/login.defs, usually 1000-60000) are processed: the other groups are admin, system or daemon groups and you probably don't want to mess with those. – ErikF Mar 20 '18 at 20:19

Probably not the best way to do it, but this might work:

awk -F: '$NF ~ "," { print $1 }' /etc/group


getent group | awk -F ':' '$4 ~ "," {print $1}'

If the 4th colon-delimited field (user list) of the group list contains a comma, then print the first colon-delimited field (group name).


as group members are comma-delimited, only multi-member groups will have commas. From these group-file lines, show only the line content before the first colon.

grep , /etc/group | cut -d: -f 1
  • What if the groups are stored in NIS or LDAP? – Jeff Schaller Mar 20 '18 at 22:32
  • depends on what data is in there, the schema used, etc. – jmullee Mar 20 '18 at 23:46
  • My point being that not everyone stores their group data in /etc/group – Jeff Schaller Mar 20 '18 at 23:47
  • indeed, maybe a new question like 'how to extract group daya from system X with schema Y using tool Z' would be useful – jmullee Mar 20 '18 at 23:59
  • I'm sorry again, I really wasn't clear with my first comment. I was saying that searching /etc/group is a common first step, but that group information may also be elsewhere. Using getent is a way to gather information from any & all repositories that are configured (including local files, LDAP, NIS, etc). – Jeff Schaller Mar 21 '18 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.