There are two ways to take a user out of one group without touching the rest.
sudo gpasswd -d user group removes them from one group. sudo usermod -G list user sets the whole list anew; you do that when you know exactly which groups must stay. The group itself stays in the system either way: its other members keep using it.
You removed bob from the deploy group. In the terminal bob opened this morning, id still shows deploy. What does that mean?
-
It worked:
id bobandsudo -u bob idshow a list without deploy. The old output comes from a process started before the removal. -
An ordinary user cannot change their own groups. A fresh process,
sudo -u bob id, shows the list without deploy. -
The group is still there; only bob was removed from it. The old list is held by the shell process started this morning.
Removal changes the account, while bob's processes started earlier live with the old list. For the removal to reach them they are restarted, for example by bob logging in again.
After a removal, check both sides: the removed group is gone, and the needed ones are in place. Look with a fresh process, sudo -u user id -nG, and compare the whole list with what the request says must remain: an extra group or a lost neighbouring one is a common mistake when revoking.
Check the groups themselves with getent group: one member was taken out of them, and there was no need to delete them, since other members use them.
Revoke the author role
labmember's author role is over: remove him from the lab-writers group. lab-readers and the primary group labmember stay, and both work groups stay in the system.
Goals · 0 of 2
- Remove labmember from lab-writers not done yet
- Keep lab-readers, the primary group, and both work groups not done yet