Manage Accounts And Groups On Elementary OS
A Linux desktop becomes much easier to share when every person has a separate account. Files, browser profiles, application settings and personal documents stay in the correct home folder, while permissions prevent one user from casually changing another user’s data. On elementary OS, the main controls live in System Settings, with a few useful group-management tasks handled in Terminal.
The graphical tools are suitable for everyday account administration, especially when setting up a family computer, a small home office or a machine used by several students. Terminal commands provide finer control when you need a service account, a particular group membership or a repeatable setup. The safest approach is to understand what each account can do before granting administrative access.
Know how accounts and groups work
Every person who signs in to elementary OS should normally have an individual user account. That account has a username, password, home directory and a numeric user ID. The home directory stores documents and hidden configuration files, usually under /home/username. A separate account means that a housemate’s browser history and SSH keys do not become mixed with yours.
A standard user can run applications, save files and customise their own desktop. An administrator can also perform system-wide tasks after authenticating with a password, such as installing software, changing network settings or creating other accounts. On Ubuntu-based systems, administrative rights are commonly provided through the sudo group. Giving someone administrator access is therefore much more significant than simply allowing them to use the computer.
Groups are collections of users that share access to files, devices or services. A group can be useful for a household folder, a development project or a hardware device that should be accessible to selected accounts. Group membership does not copy files or merge home directories; it changes which protected resources a user can access.
This distinction matters on a shared computer in Sydney, Adelaide or a regional town where family members may use one desktop for banking, schoolwork and entertainment. A separate standard account for a child or visiting relative is often a better arrangement than sharing an administrator password. It also makes troubleshooting clearer when something goes wrong.
Add a user in System Settings
Open the Applications menu, launch System Settings, and look for the Users panel. The wording and layout can vary between elementary OS releases, so the panel may be labelled User Accounts on some installations. You may need to click an unlock control and enter your own password before the account-management options become available.
Choose the option to add a user, then enter the person’s full name and account name. The full name is the friendly label shown on the login screen, while the username is used in paths and commands. Use a short, lowercase username without spaces; for example, riley is easier to work with than Riley’s Laptop Account. elementary OS may suggest a username automatically, but you can usually adjust it before creating the account.
Set a strong password or allow the new user to choose one at their first login, depending on the options offered by your release. A unique passphrase is preferable to a short word, particularly on a laptop that travels between home, university and public Wi-Fi. In Australia, where a laptop may be used at a TAFE campus in Melbourne and then at home over an NBN connection, the same local account still protects access if the device is lost or borrowed.
Select the appropriate account type before saving. Choose a standard account for ordinary daily work. Select administrator only when the person genuinely needs to install system software or manage other users. The new account may not appear until you log out or restart the session, and the first login can take a little longer while elementary OS creates the home directory and default desktop configuration.
Create and modify accounts from Terminal
Terminal is useful when the Users panel does not expose an option you need. Open Terminal from Applications and use adduser, which is designed to create a normal account interactively:
sudo adduser sam
The command asks for a password and optional profile details. The information fields can be left blank by pressing Enter. It creates /home/sam, assigns ownership correctly and adds the account to the ordinary default groups. The account will usually be ready for a graphical login immediately after creation, although the current display session may need to be logged out first.
To give an existing user administrator privileges, add them to the administrative group:
sudo usermod -aG sudo sam
The -aG combination is important. -G sets supplementary groups, while -a appends the new group to existing memberships. Leaving out -a can remove the user from other groups and cause confusing access problems. The person must sign out and sign back in before the new membership is recognised by most applications.
Use administrator access sparingly. It is appropriate for a trusted adult maintaining a household computer or for the owner of a personal workstation, but it is excessive for a guest account. A user with sudo access can alter system files, install software and inspect protected data. If you are setting up a machine for a child, a community group or a casual borrower, create a standard account instead.
For a temporary account, you can set an expiry date or remove the account later. Before deleting anything, copy documents that need to be kept. A command such as sudo deluser sam removes the login account but may leave the home directory, while sudo deluser --remove-home sam removes the account and its home folder. Check the username carefully before running the second command; recovery is much harder once personal files have been deleted.
Manage groups and shared access
Create a dedicated group when several users need access to the same resource:
sudo groupadd project
sudo usermod -aG project sam
sudo usermod -aG project alex
A group name should describe the purpose rather than a person. project, music or scanner-users is clearer than friends. To see a user’s current memberships, run:
id sam
To inspect all known groups, use:
getent group
The new group membership normally takes effect at the next login. If the user is already working in a session, logging out and back in is the most reliable solution. Some commands can start a temporary shell with updated group membership, but that can make troubleshooting less obvious for beginners.
For a shared directory, assign the group and set suitable permissions. For example:
sudo mkdir -p /srv/project
sudo chown root:project /srv/project
sudo chmod 2770 /srv/project
The 2770 mode allows the owner and group to read, write and enter the directory while denying access to everyone else. The leading 2 sets the setgid bit, causing new files and folders inside to inherit the project group. This is useful for a small household media folder or a collaborative work directory, although each application may apply its own file permissions.
Be cautious with groups connected to hardware or system services. Membership of groups such as dialout, audio or video may grant access to devices that applications normally cannot use. Group names differ between distributions and releases, so check that a group exists before adding anyone. Avoid putting users into powerful groups simply because a forum post lists them as a quick fix.
For a computer used by a local club in Brisbane or a neighbourhood workshop, a purpose-built group can be easier to audit than repeatedly changing individual file permissions. Keep the membership small, document why the group exists and remove people when their access is no longer required.
Check permissions and protect the desktop
After creating an account, test it with a normal login rather than assuming the settings are correct. Confirm that the user can open their own home folder, create a document and launch the applications they need. Then check that they cannot browse another user’s private files unless shared access was deliberately configured.
The groups command gives a quick view of the current account:
groups
You can also inspect ownership and permissions with:
ls -ld /home/sam
ls -l /home/sam
A home directory owned by the correct user should not normally be writable by unrelated accounts. If files were copied as root, ownership may be wrong, causing an application to fail when the user tries to save settings. Correct a specific file or directory carefully with chown, rather than recursively changing an entire home directory without checking what it contains.
Account separation works best alongside sensible application security. Keep elementary OS updated, use a screen lock and avoid installing untrusted packages with administrator privileges. If you are experimenting with unfamiliar desktop software, this Firejail security guide explains an additional way to restrict selected applications.
A shared computer also benefits from clear ownership rules. Decide who maintains updates, who can install software and where shared documents belong. Do not use a shared administrator login just because it is convenient. Individual accounts create a useful record of which settings were changed and make it possible to remove one person’s access without disrupting everyone else.
Troubleshoot common account problems
A newly created user may not appear at the login screen immediately. Log out of the current session, restart the computer or check whether the display manager is showing a user list instead of a manual username field. If the account still does not work, verify that it exists with:
getent passwd sam
A successful result shows the username and its home-directory path. Check that /home/sam exists and is owned by sam. If the account was created manually with a lower-level command instead of adduser, it may be missing a home directory, shell or default group setup.
If a user cannot run an administrative command, check membership with id sam. Remember that group changes usually require a complete sign-out. Typing su sam inside an existing terminal does not always reproduce the same desktop session and can give misleading results, particularly for graphical applications.
When a shared folder refuses access, inspect the directory’s owner, group and mode before changing anything. A permission error may come from a parent directory, a missing group membership or an application creating files with restrictive modes. Avoid solving every problem with chmod 777; that grants write access to everyone and can expose or damage shared data.
Removing access should be just as deliberate as adding it. To remove a user from a group without affecting other memberships, use:
sudo gpasswd -d sam project
Then sign the user out and check that the resource is no longer available. If an account is no longer needed, preserve important files first, disable or delete the account through System Settings or the appropriate command, and review any shared directories it owned.
For Australians managing a laptop during a move from Perth to Canberra, or setting up a replacement machine after a hardware failure, keep a record of usernames, group purposes and backup locations. That small note can save time when restoring files or rebuilding the system, especially if the old computer is unavailable and the new one is configured under pressure.
Start on your elementary OS computer by opening System Settings, reviewing the existing Users panel, and creating one standard test account before changing any group memberships.
