opscape

System and users

groups

Print the groups the current user, or each named user, belongs to.

groups [USER...]

7 of 7 examples run in Debian 13.7 on 2026-10-31 · coreutils 9.7-3 · manual: groups(1)

groups lists group names. With no argument it describes the current process (the groups your shell actually holds); with user names it looks each one up in the account database and prefixes the answer with user :.

It is a shorthand for id -Gn, and id is the better choice in scripts because it can print numbers and has no prefix to strip. Reach for groups at the prompt, when you want to check why you cannot open a file owned by some group, or whether adding yourself to a group has taken effect yet. To go the other way and see who is in a group, use getent group NAME.

Examples

List your own groups

groups
explain
output
dev

The sandbox user has only its primary group, dev.

List another user's groups

groups root
explain
output
root : root

With a name, the output is prefixed with user : so the answers stay readable when you ask about several users.

Ask about several users at once

groups dev root www-data
explain
output
dev : dev
root : root
www-data : www-data

One line per user, each in the user : groups form.

Get the same list from id

id -Gn
explain
output
dev

id -Gn prints exactly what bare groups prints, and id -G gives the numeric IDs.

See who is in a group

getent group sudo users
explain
output
sudo:x:27:
users:x:100:

getent group prints the group database entries: name, password placeholder, GID, then the comma-separated member list. Both groups are empty in this sandbox, so the last field is blank. A user's primary group membership never appears in that list; it is recorded in /etc/passwd.

Check membership in a script

if groups | tr ' ' '\n' | grep -qx docker; then
  echo "can use docker"
else
  echo "not in the docker group: ask an admin, then log in again" >&2
  exit 1
fi
outputexit 1
not in the docker group: ask an admin, then log in again

Splitting the list onto separate lines and matching a whole line with grep -x avoids false matches such as docker inside dockerusers.

Ask about a user that does not exist

groups nobody-here
explain
outputexit 1
groups: ‘nobody-here’: no such user

An unknown name is reported on stderr and the exit status is 1.

Common pitfalls

  • Adding yourself to a group and expecting groups to show it in the same session. Bare groups reports the running shell, which keeps the list it got at login; groups $USER reads the database and shows the change at once. Log out and in again, or run newgrp GROUP.

  • Reading getent group G as the complete member list. Users whose primary group is G are not listed there.

GNU vs BSD and macOS

The examples above ran the GNU/Linux version. These are the differences that matter on macOS and the BSDs (written from their documentation, not run here).

  • On macOS, groups exists but group membership also comes from Directory Services; id -Gn and dscl . -read /Groups/NAME GroupMembership are the usual tools there.

Options worth knowing

A selection, described in our own words. For the full list, see groups(1) or groups --help.

OptionWhat it does
--helpPrint usage and exit.
--versionPrint the coreutils version and exit.

Related