List Privileged Group Members

You need to review accounts listed in privileged groups such as sudo, adm, or docker.

Command

awk -F: '$1 ~ /^(sudo|adm|docker)$/ && $4 != "" {print $1 ": " $4}' fixtures/user-access-audit/etc/group

Before you run this

Risk: safe. Do not remove group members from this output alone; confirm role ownership, automation, and approval records first.

Expected output

Privileged group names followed by their listed members.

System impact

Nothing changes. The command reads a fixture-local group stub and prints populated privileged groups.

Recovery / rollback: no state is changed.

When to use it

Use during access reviews when group membership may grant root, log, or runtime control.

When not to use it

Do not remove group members from this output alone; confirm role ownership, automation, and approval records first.

Watch this command run

Example output from a temporary Linux lab

This example uses disposable sample files and sanitized output so you can inspect the shape of the result before touching a real system.

demo@lab:~$

$ cat sample-files/user-access-audit/etc/group

root:x:0:
daemon:x:1:
www-data:x:33:
alex:x:1000:
deploy:x:1001:
reports:x:1002:
breakglass:x:1003:
backup:x:1004:
sudo:x:27:alex,breakglass
docker:x:998:deploy
adm:x:4:alex

$ awk -F: '$1 ~ /^(sudo|adm|docker)$/ && $4 != "" {print $1 ": " $4}' sample-files/user-access-audit/etc/group

sudo: alex,breakglass
docker: deploy
adm: alex

View reproducible demo details

This page shows the sanitized shell transcript and the setup steps needed to reproduce the example.