We are getting ready to migrate to Active Directory-based Samba, from the old style domain. Currently all our groups are flat - users belong to groups, but groups can't belong to other groups. Since I want to change that, I need to list all the groups with users.

The catch is that there are thousands of users, and thousands of groups. What I need is to list the groups with 2 or more members, then only show the group name on the command line. This should eliminate user-groups, or groups with only one user.

How can I do this in Debian?

  • @Jesse_b : I’m just saying, whatever input file you pictured in mind when you posted your awk answer, I just asked the OP to post a snippet of it, or Atleast mention the file is /etc/group.
    – Inian
    Mar 20, 2018 at 16:54
  • You probably want to make sure that only groups with a GID between [GID_MIN, GID_MAX] (from /etc/login.defs, usually 1000-60000) are processed: the other groups are admin, system or daemon groups and you probably don't want to mess with those.
    – ErikF
    Mar 20, 2018 at 20:19

3 Answers 3



getent group | awk -F ':' '$4 ~ "," {print $1}'

If the 4th colon-delimited field (user list) of the group list contains a comma, then print the first colon-delimited field (group name).


Probably not the best way to do it, but this might work:

awk -F: '$NF ~ "," { print $1 }' /etc/group

as group members are comma-delimited, only multi-member groups will have commas. From these group-file lines, show only the line content before the first colon.

grep , /etc/group | cut -d: -f 1
  • What if the groups are stored in NIS or LDAP?
    – Jeff Schaller
    Mar 20, 2018 at 22:32
  • depends on what data is in there, the schema used, etc.
    – jmullee
    Mar 20, 2018 at 23:46
  • My point being that not everyone stores their group data in /etc/group
    – Jeff Schaller
    Mar 20, 2018 at 23:47
  • indeed, maybe a new question like 'how to extract group daya from system X with schema Y using tool Z' would be useful
    – jmullee
    Mar 20, 2018 at 23:59
  • I'm sorry again, I really wasn't clear with my first comment. I was saying that searching /etc/group is a common first step, but that group information may also be elsewhere. Using getent is a way to gather information from any & all repositories that are configured (including local files, LDAP, NIS, etc).
    – Jeff Schaller
    Mar 21, 2018 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.