User & Group Management

Lock out accounts without nuking their data

🧩 The Challenge

Someone leaves the company on bad terms and you need to kill their access immediately without accidentally deleting their entire home directory structure. I’ve spent too much time dealing with frantic HR requests where I have to play surgical technician with account status.

💡 The Fix

Instead of messing with usermod and potentially breaking file ownerships, just lock the password field and change the login shell to nologin. It keeps the data intact but makes the account impossible to crack into.

usermod -L -s /sbin/nologin username

⚙️ Why It Works

Adding the L flag forces the password hash to be prefixed with an exclamation mark, which invalidates it, while swapping the shell to nologin prevents anyone from spawning a bash session as that user.

🚀 Pro-Tip: Use chage -E 0 username if you want to set an account expiration date that happens automatically.

Linux Tips & Tricks | © ngelinux.com | 10/15/2026