18.3 Create, Delete, and Modify Local Groups and Memberships

Red Hat Certified System Administrator RHCSA

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Lab Setup & Performance-Based Study Strategy

2 Essential Tools: Shell, Redirection & Text Analysis

2.1 Shell Prompt and Command Syntax 2.2 Input-Output Redirection and Pipes 2.3 grep and Regular Expressions for Text Analysis

3 Essential Tools: Remote Access, Users & Text Editing

3.1 Access Remote Systems Using SSH 3.2 Log In and Switch Users in Multiuser Targets 3.3 Create and Edit Text Files

4 Essential Tools: Files, Links & Archives

4.1 Create, Delete, Copy, and Move Files and Directories 4.2 Hard and Soft Links 4.3 Archive and Compress with tar, gzip, and bzip2

5 Essential Tools: Permissions & System Documentation

5.1 List, Set, and Change Standard ugo/rwx Permissions 5.2 System Documentation: man, info, and /usr/share/doc

6 Manage Software: RPM and Flatpak

6.1 Configure Access to RPM Repositories 6.2 Install and Remove RPM Software Packages 6.3 Configure Access to Flatpak Repositories 6.4 Install and Remove Flatpak Software Packages

7 Create Simple Shell Scripts

7.1 Conditional Execution: if, test, and [] 7.2 Looping Constructs for Files and Input 7.3 Process Script Inputs ($1, $2, and Beyond) 7.4 Process Shell Command Output in Scripts

8 Operate Running Systems: Boot and Recovery

8.1 Boot, Reboot, and Shut Down a System Normally 8.2 Boot Systems into Different Targets Manually 8.3 Interrupt the Boot Process to Gain Access

9 Operate Running Systems: Processes and Tuning

9.1 Identify and Kill CPU/Memory Intensive Processes 9.2 Adjust Process Scheduling 9.3 Manage Tuning Profiles

10 Operate Running Systems: Logs, Services & File Transfer

10.1 Locate and Interpret System Log Files and Journals 10.2 Preserve System Journals 10.3 Start, Stop, and Check Status of Network Services 10.4 Securely Transfer Files Between Systems

11 Configure Local Storage: Partitions and LVM

11.1 List, Create, and Delete Partitions on GPT Disks 11.2 Create and Remove Physical Volumes 11.3 Assign Physical Volumes to Volume Groups 11.4 Create and Delete Logical Volumes

12 Configure Local Storage: Mounting and Expansion

12.1 Mount File Systems at Boot by UUID or Label 12.2 Add Partitions, Logical Volumes, and Swap Non-Destructively

13 Create and Configure File Systems: Local FS and Permissions

13.1 Create, Mount, and Use VFAT, ext4, and XFS File Systems 13.2 Extend Existing Logical Volumes 13.3 Diagnose and Correct File Permission Problems

14 Create and Configure File Systems: NFS and autofs

14.1 Mount and Unmount Network File Systems Using NFS 14.2 Configure autofs

15 Deploy and Maintain: Scheduling, Services & Targets

15.1 Schedule Tasks with at, cron, and systemd Timers 15.2 Start, Stop, and Enable Services at Boot 15.3 Configure Systems to Boot into a Specific Target

16 Deploy and Maintain: Time, Software Updates & Bootloader

16.1 Configure Time Service Clients 16.2 Install and Update Software from CDN, Remote Repos, and Local Files 16.3 Modify the System Bootloader

17 Manage Basic Networking

17.1 Configure IPv4 and IPv6 Addresses 17.2 Configure Hostname Resolution 17.3 Configure Network Services to Start Automatically at Boot 17.4 Restrict Network Access Using firewalld and firewall-cmd

18 Manage Users and Groups

18.1 Create, Delete, and Modify Local User Accounts 18.2 Change Passwords and Adjust Password Aging 18.3 Create, Delete, and Modify Local Groups and Memberships 18.4 Configure Privileged Access

19 Manage Security: Firewall, umask & SSH Keys

19.1 Configure Firewall Settings with firewall-cmd and firewalld 19.2 Manage Default File Permissions 19.3 Configure Key-Based Authentication for SSH

20 Manage Security: SELinux Modes and Contexts

20.1 Set Enforcing and Permissive Modes for SELinux 20.2 List and Identify SELinux File and Process Contexts 20.3 Restore Default File Contexts

21 Manage Security: SELinux Ports and Booleans

21.1 Manage SELinux Port Labels 21.2 Use Boolean Settings to Modify SELinux Settings

18.3 Create, Delete, and Modify Local Groups and Memberships

Key Takeaways Explain This Topic AI

Create local groups with groupadd (-g for fixed GID, -r for system groups); modify with groupmod; delete with groupdel only when no user still uses the group as primary.

Add or remove supplementary members with gpasswd -a/-d or usermod -aG; usermod -g changes the primary group in /etc/passwd.

usermod -G without -a and gpasswd -M replace membership lists—use append forms when you must preserve existing groups such as wheel.

Primary group is the GID in passwd; supplementary members are listed in /etc/group—id and getent group are the verification tools.

Group changes persist in account databases immediately; interactive sessions may need re-login to pick up new membership for access checks.

Last updated: August 2026

18.3 Create, Delete, and Modify Local Groups and Memberships

Quick Answer: Create groups with groupadd , modify with groupmod , delete with groupdel . Manage membership with gpasswd , usermod -aG , or gpasswd -a/-d . Primary group vs supplementary groups differ: primary is the GID in /etc/passwd ; supplementary lists appear in /etc/group member fields. Verify with getent group , id user , and groups user .

Why groups dominate multiuser tasks

EX200 group tasks appear alone or combined with users and permissions:

“Create group developers with GID 30000.”
“Ensure alice and bob are members of developers .”
“Change the primary group of alice to developers .”
“Remove temp from contractors without deleting the user.”
“Delete empty group oldteam .”

Shared directories (SGID project dirs) depend on correct group existence and membership . Get groups right before chasing mode bits.

Group database
/etc/group format groupname:x:GID:member1,member2
developers:x:30000:alice,bob

Field Meaning
name Group name
x Password placeholder (rarely used day-to-day)
GID Numeric group id
members Comma-separated supplementary members

Important: A user’s primary group membership is not always listed in the member field. Primary is the GID in /etc/passwd . Tools like id show both. getent group developers

getent passwd alice
id alice
groups alice
/etc/gshadow

Stores group passwords and group administrator lists. RHCSA tasks more often use gpasswd membership operations than group password logins. Know that gpasswd updates group-related databases safely.

groupadd: create groups sudo groupadd developers
sudo groupadd -g 30000 developers
sudo groupadd -r sysproj # system group (system GID range)
getent group developers

Option Purpose
g GID Fixed group ID
r System group

-f Exit successfully if group already exists (force/exit quiet behavior—check man on your version for exact semantics)

K KEY=VAL Override login.defs-style defaults when supported # Idempotent-ish exam pattern when unsure
getent group developers || sudo groupadd -g 30000 developers

If a task specifies GID , use -g . Collisions with existing GIDs fail—choose the required ID and fix conflicts only as tasks allow.

groupmod: rename or renumber sudo groupmod -n newname oldname
sudo groupmod -g 31000 developers
getent group developers

Changing GID does not rewrite all file group ownerships automatically—files keep old numeric GIDs until chgrp / chown . Prefer correct -g at create time .

groupdel: remove groups sudo groupdel oldteam

You cannot delete a group that is still the primary group of an existing user. Reassign those users’ primary groups first: id alice # if primary is oldteam

sudo usermod -g users alice # or another allowed primary
sudo groupdel oldteam

Supplementary-only membership is cleared when appropriate; still verify no primary dependency remains.

Membership management tools
usermod (from 18.1, group-focused) # Primary group
sudo usermod -g developers alice

# Append supplementary
sudo usermod -aG developers alice

# Replace all supplementary (danger)
sudo usermod -G developers,contractors alice
gpasswd (group-centric) sudo gpasswd -a alice developers # add member
sudo gpasswd -d alice developers # remove member
sudo gpasswd -A alice developers # set group administrators (less common on exam)
sudo gpasswd -M alice,bob developers # set member list exactly
gpasswd developers # set group password (rare on EX200)

Command Typical use
gpasswd -a user group Add one supplementary member
gpasswd -d user group Remove one member
gpasswd -M u1,u2 group Define exact member list
usermod -aG group user Add supplementary from user-centric workflow
usermod -g group user Change primary group

Exam tip: gpasswd -M replaces the member list like usermod -G replaces supplementary groups—read before you wipe members.

Alternative: groupmems (if available)

Some systems include groupmems for membership edits. Stick to gpasswd and usermod for portable RHCSA muscle memory. # Optional awareness

type groupmems 2>/dev/null
Primary vs supplementary (deep enough for EX200)

Kind Where stored Effect on new files
Primary GID field of /etc/passwd Default group ownership for newly created files (unless SGID dir/other rules)

Supplementary Member lists in /etc/group (+ NSS) Grants access based on group permissions when primary is not the file’s group id -un

id -gn # primary group name
id -Gn # all group names
id alice

A user can access a file mode 640 owned by root:developers if they are in developers (primary or supplementary) and the group has read—subject to DAC and SELinux.

Session caveat

Group membership changes apply to new sessions . An already-open SSH login may still show old id output until the user logs out and back in (or uses a new login). For grading end state, id user as root and getent group are authoritative on disk even if a leftover session is stale. id alice

sudo -u alice id
getent group developers
Creating users already in groups (review) sudo groupadd -g 30000 developers
sudo useradd -m -s /bin/bash -g developers -G wheel,contractors alice
id alice

-g primary, -G supplementary at create time avoids a second membership step—still verify.

Shared project directory pattern (group + perms preview)
Though full permission objectives live elsewhere, group tasks often pair with: sudo groupadd projecta
sudo useradd -m -s /bin/bash -G projecta dev1
sudo useradd -m -s /bin/bash -G projecta dev2
sudo mkdir -p /srv/projecta
sudo chgrp projecta /srv/projecta
sudo chmod 2770 /srv/projecta # SGID + group rwx common pattern
ls -ld /srv/projecta
id dev1

Membership without directory group ownership fails collaboration; directory group without membership also fails. Deliver both when the scenario needs shared write access.

Listing and auditing membership getent group developers
grep developers /etc/group
lid -g developers 2>/dev/null || true # if libuser tools present

# parse members:

getent group developers | awk -F: '{print $4}'
For each required user: id dev1 | grep -E 'developers|groups'
Exam workflows
Workflow A — Group with fixed GID sudo groupadd -g 30000 developers
getent group developers

Workflow B — Add three users to a group without destroying other memberships for u in alice bob carol; do sudo usermod -aG developers "$u"; done

getent group developers
id alice; id bob; id carol
Or: sudo gpasswd -a alice developers
sudo gpasswd -a bob developers
sudo gpasswd -a carol developers
Workflow C — Change primary group sudo groupadd -f staff
sudo usermod -g staff alice
id alice
getent passwd alice
Workflow D — Remove membership only sudo gpasswd -d alice contractors
id alice
getent group contractors
Workflow E — Rename group and verify sudo groupmod -n developers eng
getent group developers
getent group eng
Workflow F — Delete group safely # ensure no user has it as primary
getent passwd | awk -F: -v g=$(getent group oldteam | cut -d: -f3) '$4==g{print $1}'
sudo groupdel oldteam
Common traps

Expecting primary group to appear in /etc/group member list always—it may not.

usermod -G without -a removing wheel and other supplementary groups.

gpasswd -M accidentally wiping members by omitting names.

groupdel failing because the group is still some user’s primary group.

Creating group after useradd -g failed—order groups first.

Wrong GID when task mandates a number.

Assuming membership works in an old SSH session without re-login when testing interactively.

Hand-editing /etc/group and breaking commas/field counts.

Deleting a group while shared files still use that GID—files show numeric GIDs afterward.

Forgetting to getent group + id before marking the task done.

Relationship to other sections

18.1 Users: primary and supplementary assignment at create/modify time.

18.2 Passwords: orthogonal; groups do not replace authentication.

18.4 Privileged access: wheel is a group membership problem first.

Permissions / ACLs / SGID dirs: collaboration design rests on GIDs and members.

NFS / multiuser services: UIDs/GIDs consistency matters across systems (local chapter focuses on one host).

Section checkpoint

You should create groups with groupadd (including -g ), rename/renumber with groupmod , remove with groupdel only when safe, add/remove members with gpasswd and usermod -aG , distinguish primary vs supplementary , avoid destructive -G / -M replacements, and verify with getent group and id . That is the EX200 standard for local groups and memberships on RHEL 10.