User & Group Management

Lock a user out, don’t delete ’em (yet)

🧩 The Challenge

Somebody leaves the team or, worse, there’s a security incident. Your first thought might be to nuke their account. But then you realize you might need their data or want to preserve their account for auditing.

💡 The Fix

Instead of a full deletion, just lock the account. It revokes their ability to log in while keeping their home directory and all their files intact. Perfect for when you need to investigate later or just put someone on ice.

sudo usermod -L baduser
# To unlock:
sudo usermod -U baduser

⚙️ Why It Works

This works by effectively disabling the user’s password, making it impossible for them to authenticate. The user account itself remains untouched, along with its UID, GID, and home directory.

🚀 Pro-Tip: Want to see if an account is locked? Check /etc/shadow for an exclamation mark at the start of the password hash.

Linux Tips & Tricks | © ngelinux.com | 9/23/2026