Deleting Users

Deleting Users in Ubuntu

Deleting a user account on Ubuntu is irreversible once the home directory is removed. In production environments, it is often better to disable an account rather than delete it, so that file ownership and audit logs remain intact. When deletion is appropriate, understanding what each deletion command does — and what it leaves behind — prevents data loss and orphaned files.

Before you delete a user

# 1. Verify the user is not currently logged in
who | grep irfan
w irfan

# 2. Find all files owned by the user before deleting
find / -user irfan 2>/dev/null | tee /tmp/irfan-files.txt

# 3. Check running processes owned by the user
ps aux | grep "^irfan"

# 4. Check for cron jobs belonging to the user
crontab -u irfan -l

# 5. Kill any running processes if the user is logged in
sudo pkill -u irfan
sudo killall -u irfan

userdel vs deluser

Deleting a user account

# Option 1: Interactive (recommended for manual use)
# Remove user, home directory, and mail spool
sudo deluser --remove-home irfan

# Option 2: Low-level (scripts/automation)
# Remove user and home directory
sudo userdel -r irfan

# Option 3: Remove user but keep home directory intact
# (useful when you want to archive the data first)
sudo userdel irfan
# Home directory /home/irfan still exists, owned by old UID

# Verify deletion
id irfan           # Should return: no such user
ls -la /home/      # Check if home dir was removed
getent passwd irfan  # Should return nothing

⚠️ WARNING: userdel -r permanently removes /home/username and the mail spool. There is no undo. Back up important user data before deletion, or disable the account instead. If the user owned files outside the home directory (set-by find / -user username), those files will become orphaned (showing UID number instead of a name in ls -l output).

Handling files after deletion

# After deletion, find files that belong to the old UID (now orphaned)
# Replace 1001 with the old UID from the deleted account
sudo find / -nouser 2>/dev/null

# Re-assign orphaned files to another user or root
sudo find / -nouser -exec chown root:root {} \;

# Or archive the home directory before deletion
sudo tar -czf /backup/irfan-home-$(date +%Y%m%d).tar.gz /home/irfan/
sudo userdel -r irfan

Disabling instead of deleting

On servers with audit requirements, consider disabling accounts instead of deleting them. Disabled accounts appear in logs and file ownership is preserved, but the user cannot log in.

# Method 1: Lock the account (prevents password-based login)
sudo usermod -L irfan
sudo passwd --lock irfan    # Alternative

# Method 2: Set the shell to nologin (prevents all logins including SSH keys)
sudo usermod -s /usr/sbin/nologin irfan

# Method 3: Set an expiry date to today (expires immediately)
sudo usermod -e $(date +%Y-%m-%d) irfan

# Method 4: Expire the password (force-disables without lockout for SSH key users)
sudo passwd --expire irfan

# Verify account is locked
sudo passwd --status irfan    # Shows 'L' for locked

Conclusion

Before deleting any user account on a production server, find all files owned by them with find / -user username, back up the home directory, and confirm they are not logged in. Use deluser --remove-home for interactive deletion. Prefer disabling (usermod -L or usermod -s /usr/sbin/nologin) over deletion on systems with audit requirements — you preserve file ownership and log history, and re-enabling is trivial if needed.