useradd: create and manage user accounts

Updated November 2026

useradd, usermod and userdel create, change and remove user accounts on Linux. Groups are handled by groupadd and friends, and passwords by passwd.

useradd [options] login usermod [options] login userdel [-r] login

Create a user

sudo useradd -m -s /bin/bash -c "Anna Novak" anna   # -m creates /home/anna
sudo passwd anna                                     # set a password
sudo chage -d 0 anna                                 # must choose a new one at first login
id anna                                              # uid, gid and groups

On Debian and Ubuntu, adduser anna is a friendlier front end that asks for the details and creates the home directory automatically. On RHEL, useradd creates the home directory by default.

Groups

sudo groupadd developers
sudo usermod -aG developers anna        # ADD to a group (-a is essential!)
sudo usermod -aG sudo,docker anna       # several groups
sudo gpasswd -d anna docker             # remove from one group
groups anna
getent group developers

Do not forget -a

usermod -G developers anna without -a replaces all of anna's supplementary groups with just "developers", silently removing her from sudo and everything else.

Group changes take effect at the user's next login.

Change an account

sudo usermod -s /usr/bin/zsh anna       # new login shell
sudo usermod -l anna.novak anna         # rename the login (rename the home directory separately)
sudo usermod -d /home/anna.novak -m anna.novak   # move the home directory
sudo usermod -c "Anna Novak, IT" anna   # comment / full name

Lock, expire and unlock

sudo usermod -L anna                    # lock the password (SSH keys still work!)
sudo usermod -e 1 anna                  # expire the account: no login at all
sudo usermod -U -e "" anna              # unlock and remove the expiry
sudo chage -E 2026-12-31 contractor     # expire on a date
sudo chage -l anna                      # password and account ageing details

Locking the password does not stop key-based SSH logins; expire the account as well, or remove the user's authorized_keys.

Accounts for services

sudo useradd --system --home-dir /var/lib/myapp --shell /usr/sbin/nologin myapp

System accounts get a low user ID, no password and a shell that refuses logins. Run each service under its own account.

Remove a user

sudo pkill -u anna                      # end running processes
sudo crontab -r -u anna                 # remove scheduled jobs
sudo userdel -r anna                    # delete the account, home directory and mail spool
sudo find / -xdev -user anna            # (before userdel) files elsewhere owned by anna

Archive the home directory first if anything in it might be needed. See account security for the complete leaver checklist.

Other systems

FreeBSD uses adduser and pw useradd; AIX uses mkuser, chuser and rmuser; macOS uses sysadminctl or dscl. With central directories (LDAP, FreeIPA, Active Directory), create users there, not on each server.