Learn Understand first, then practice while the concept is still fresh.

M14 - Users and Groups: CLI

Inspect identities, groups, and local accounts from the command line, starting with safe read-first commands before making account changes.

Permissions

Users and Groups: CLI

Inspect identities, groups, and local accounts from the command line, starting with safe read-first commands before making account changes.

40 min INTERMEDIATE BOTH Curriculum-reviewed
Prerequisites
Module M12 - Who Owns What: Users and Groups Module M13 - Users and Groups: GUI
What you should be able to do after this
  • Identify the current account from the CLI.
  • Inspect group membership and local account information.
  • Understand why read-first account inspection should come before account modification.

Why This Matters

The CLI gives you a clearer view of identity than many graphical tools do.

More importantly, it lets you inspect accounts on machines that may not even have a desktop environment.

For this stage, focus on safe observation first. Creating or deleting accounts comes later and should be practiced deliberately.

1. Ask the System Who You Are

The most basic identity question is still useful: who is the current user?

Current Identity on Windows

whoami

Current Identity on Linux

whoami id groups

These commands answer slightly different questions:

  • whoami shows the current username
  • id shows numeric identifiers and group membership on Linux
  • groups focuses on group names

2. Inspect Local Accounts

Once you know your own identity, the next step is to inspect what other local accounts exist.

Inspect Local Accounts on Windows

Get-LocalUser Get-LocalGroupMember -Group “Administrators” net user

Inspect Local Accounts on Linux

getent passwd | head getent group | head

You do not need to memorize every field yet. Learn to recognize the big picture: the machine has multiple identities and many of them are service accounts rather than human users.

3. Modification Comes After Understanding

It is tempting to jump straight to useradd, usermod, or account deletion commands. Resist that urge until the read-first side is comfortable.

Beginner Safety Rule

If the command can lock someone out or remove access, practice it on a disposable machine or VM first. Inspection commands are where your foundation should begin.

That rule matters because user and group changes affect sign-in, file ownership, service behavior, and privilege boundaries.

What to Ignore for Now

  • domain joining and enterprise directory tools
  • password aging policies in detail
  • full account lifecycle automation

The goal here is not advanced account administration yet. It is understanding how to inspect identity from the terminal safely.

Before You Move On

You are ready when you can:

  1. identify the current user from the CLI
  2. inspect local users or groups on your platform
  3. explain why account modification should start on a test system

Next, we connect identity to the actual permission models that decide access.