Userdel under Linux: deleting an account without deleting the wrong home directory

You need to remove an old technician’s account or clean up a local user account that is no longer needed. The command seems simple, but his option -r It can delete the personal folder along with its data. A mistake in the account name or an unusual home directory is enough to delete the wrong folder.

I recommend separating the account deletion from the file deletion. Start by noting the UID, home directory, groups, sessions, and processes. Then decide whether the data should be archived, transferred, or deleted. This method takes a few minutes and avoids irreversible data loss.

Confirm the local account and personal file

In the following examples, replace alice using the correct login. First, verify the account with multiple sources:

getent passwd alice
grep '^alice:' /etc/passwd
id alice

getent may return an account from LDAP, SSSD, or another directory. If the user appears with getent but not in /etc/passwddo not launch userdel Blindly: process the account in the directory that manages it. The guide for list Linux users details this difference between local accounts and accounts provided by NSS.

Next, save the UID and home path in your administration session:

uid=$(id -u alice)
home=$(getent passwd alice | cut -d: -f6)
echo "UID=$uid HOME=$home"
id -nG alice
sudo ls -ld "$home"

Review the output before continuing. A service account can have a home directory. /var/lib, /srv or a shared directory. Don’t rely on the prefix alone. /homeAlso check that you are not deleting your own SSH account, or an account used by an application.

Control sessions, processes, and scheduled tasks

An account that is not visible on the login screen may still be running a service, backup, or cron job. Review sessions and processes before stopping them:

who
w
loginctl list-sessions
pgrep -a -u alice
ps -u alice -o pid,ppid,lstart,cmd

If you find a business process, identify its service and transfer its configuration to a technical account before deleting it. kill -9 This is not a procedure for an employee’s departure. The article on kill on Linux explains how to request a clean stop and read the newspapers before forcing your way through.

Also check the crontab and systemd units that reference this login:

sudo crontab -u alice -l
[:space:]sudo grep -R --line-number '^[]*User=alice[]*$' /etc/systemd/system /usr/lib/systemd/system 2>/dev/null[:space:]

The setup USERDEL_CMD In /etc/login.defs It can launch a script to clean up cron, at, or print jobs, but it’s not the same on all distributions. confirms that the result of this script is not taken into account by userdelTherefore, save or delete tasks explicitly before the account.

To temporarily freeze password authentication during your checks:

sudo passwd -l alice

This lock does not close active sessions and does not necessarily block SSH keys. Check these access points separately. The guide on details this limit.

The user’s home folder is not the only place where a user can store files. Look for their UID in the locations used by the server:

sudo find /home /srv /var/www -xdev -uid "$uid" -print

prevents each search from traversing to another filesystem; therefore, repeat the command on the affected data mounts. Avoid a find / improvised on a production server or very large network storage.

If the data needs to be kept, check the available space and then create an archive of the home directory:

df -h /root "$home"
sudo du -sh "$home"
sudo tar --one-file-system -C "$(dirname "$home")" -czf "/root/alice-home-$(date +%F).tar.gz" "$(basename "$home")"
sudo tar -tzf "/root/alice-home-$(date +%F).tar.gz" | head

A readable archive list is no substitute for a tested restore. For an important home directory, use your usual backup or a snapshot, then test a few restored files on a different location.

Choose between keeping the home directory and deleting it.

The order without -r removes the account from system files, but keeps its personal folder:

sudo userdel alice

This is my default choice when the data hasn’t yet been validated by its owner or transferred to another account. You can delete the directory later, after review.

If the home and local mailbox really need to disappear, use:

sudo userdel -r alice

According to the userdel man page, -r It deletes the home and mail spool folders, but not user-owned files on other file systems. Therefore, this command does not replace the inventory performed using the UID.

Do not use userdel -f to bypass a message indicating active processes. This option ignores security checks and may leave the system in an inconsistent state. Return to pgrepIdentify the service in question, shut it down properly, then restart the deletion process.

Check what remains after userdel

Keep the same shell session to preserve the variables $uid And $homeThen check the result:

getent passwd alice || echo "Account not available"
id alice
pgrep -a -u "$uid"
test -e "$home" && sudo ls -ld "$home" || echo "Personal folder missing"
sudo find /home /srv /var/www -xdev -uid "$uid" -ls

id alice This should indicate that the login no longer exists. If files remain with the old UID, decide folder by folder whether they should be archived, reassigned, or deleted. Do not apply a chown -R global without knowing the role of the data.

Finally, check the groups, systemd configurations, SSH keys copied elsewhere, and scheduled tasks before deletion. The UID could be reused by a new account in the future: leaving orphaned files unaddressed creates a permissions problem that is difficult to detect.