Recommended Free Tools
The right command depends on what “users” means. Run getent passwd to enumerate accounts resolved through Linux’s Name Service Switch (NSS), including configured directory services. Run cut -d: -f1 /etc/passwd for usernames in the local account file only. Run who or users to see accounts with active login sessions. These commands answer different questions, so choosing the scope first prevents misleading results.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the user list you actually need
Linux can hold identity information in more than one place. The traditional local database is /etc/passwd, but a machine may also resolve accounts from LDAP, SSSD, NIS, or another NSS backend. A login session is a third category: it is temporary activity, not an inventory of every account.
As an Amazon Associate I earn from qualifying purchases.
| Question | Command | Scope | Typical output |
|---|---|---|---|
| Which accounts can this host resolve? | getent passwd |
NSS passwd database, including configured network sources | Complete colon-separated passwd records |
| Which accounts are defined locally? | cut -d: -f1 /etc/passwd |
The local /etc/passwd file |
Local login names only |
| Who is logged in right now? | who |
Current login sessions | Names plus terminal, time, and session details |
| Show a compact list of logged-in names | users |
Current login sessions | Names only, usually on one line |
For general identity enumeration on a host that might use centralized authentication, getent passwd is the safest default. Use the file command deliberately when you want local accounts and do not want directory-service entries.
List every account resolved through NSS
Print complete records
Open a terminal and run:
getent passwdgetent queries the configured Name Service Switch database. For the passwd database, that can include /etc/passwd and any directory or identity services listed in the system’s NSS configuration. Each returned line is one passwd record.
#1 Best Overall
This is different from reading a file: the result represents what the operating system can resolve through its configured identity sources. On a workstation using only local accounts, it may look identical to /etc/passwd. On a server joined to a directory, it can contain names that do not appear in the local file.
Print only login names
getent passwd | cut -d: -f1The cut command treats the colon as the delimiter and selects field one, which is the login name. This form is convenient for scripts and quick visual checks, while the unfiltered command preserves UID, home-directory, shell, and other account fields.
Free tools Windows power users keep installed
One-click scans. No signup required.
Look up one name
getent passwd aliceReplace alice with the account name you want to test. A returned record means at least one configured NSS source resolved that name. An empty result means no matching entry was returned by those sources; it does not prove that a similarly named account exists in an unrelated application database.
List local accounts from /etc/passwd
Show local usernames only
cut -d: -f1 /etc/passwdThis reads the local account file directly and extracts its first, name-bearing field. It is the appropriate answer to “Which usernames are stored on this machine’s local passwd file?” It intentionally excludes accounts supplied only by LDAP, SSSD, NIS, or another NSS source.
Inspect complete local records
less /etc/passwdYou can also use cat /etc/passwd when the file is short enough to fit a terminal. The Linux man-pages project describes this file as “a text file that describes user login accounts for the system.” The wording describes the local file; it does not promise that every identity recognized by the host is stored there.
Do not edit /etc/passwd manually for ordinary account administration. Use the distribution’s account-management tools so related files, permissions, home directories, and groups remain consistent.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →See users who are logged in now
Use who for session details
whowho reports current login sessions, not the complete account database. Its output commonly includes a username, terminal, login date and time, and session-origin information. The command is useful when you need to know who is actively connected rather than who could log in.
The command supports options documented by who(1). who --users shows names with idle-time information, while who --count adds a count to the names. Option availability can vary with the implementation installed on your system, so consult man who if an option is rejected.
Use users for a compact view
usersusers prints a compact names-only view of current sessions. It is useful in a quick status check, but it deliberately omits the account records and metadata returned by getent passwd.
Understand a passwd record before parsing it
A passwd record is colon-separated. A typical line has seven fields:
- Login name: the account name used for identification.
- Password field or status marker: on systems using shadow passwords, this commonly contains
xrather than a password hash. - Numeric UID: the user identifier used by the kernel and file ownership.
- Numeric primary GID: the account’s primary group identifier.
- GECOS/comment field: descriptive text such as a person’s full name.
- Home directory: the path selected as the account’s home.
- Login shell: the program started for an interactive login, when applicable.
For example, to display the fields of one local record without changing it, run:
getent passwd aliceOn a shadow-password system, the protected shadow database stores password hashes. The visible x is therefore not a password and should not be treated as one. Reading the passwd database is not a way to recover credentials.
Show normal human accounts without assuming a universal UID rule
Linux installations commonly create service and system accounts alongside people’s login accounts. UID ranges are often used as a convention to distinguish them, but allocation policies differ by distribution, release, installation history, and local administration. A single hard-coded cutoff is therefore not universal.
Prefer an account-aware utility when available
On systems that provide the util-linux lslogins utility, try:
lslogins -uIts account-oriented report is designed for inspecting user accounts rather than blindly assuming that every passwd entry represents a person. Check man lslogins on the target host because supported options and displayed columns depend on the installed util-linux version.
Rank #4
Filter by the local policy, not a copied number
If you need a names-only pipeline and your distribution defines a regular-user starting point in /etc/login.defs, read that policy value and use it as the threshold instead of embedding a number:
uid_min=$(awk '$1 == "UID_MIN" {print $2; exit}' /etc/login.defs)
awk -F: -v min="$uid_min" '$3 >= min {print $1}' /etc/passwdThis example filters the local file, so it does not discover human accounts that exist only in a directory service. It also depends on a usable UID_MIN setting. If that setting is absent or your organization uses a different allocation policy, inspect the local documentation and account-management configuration before choosing a range.
Remember what the filter cannot prove
- A high UID does not guarantee that an account belongs to a person; administrators can assign identifiers outside customary ranges.
- A low UID does not automatically identify a service account; legacy installations may have unusual allocations.
- Filtering
/etc/passwdmisses directory-backed users unless you perform an equivalent policy-aware query through NSS.
Compare the commands by scope and output
| Command | Identity source | Directory-service awareness | Detail level | Best use |
|---|---|---|---|---|
getent passwd |
NSS passwd database | Yes, when configured in NSS | Full records | Enumerating accounts the host can resolve |
getent passwd | cut -d: -f1 |
NSS passwd database | Yes, when configured in NSS | Names only | Feeding resolved usernames to a script or review |
cut -d: -f1 /etc/passwd |
Local passwd file | No | Names only | Auditing local account entries |
who |
Current session records | Shows sessions, not an account inventory | Session details | Finding who is logged in now |
users |
Current session records | Shows sessions, not an account inventory | Names only | Fast, compact session check |
Build safe checks and small scripts
Count resolved records
getent passwd | wc -lThis counts lines returned by NSS at the time of the query. It is a count of returned records, not a guaranteed count of unique people; service accounts, duplicate-looking entries from different sources, and directory policies can affect interpretation.
Test an account in a shell script
if getent passwd "$1" >/dev/null; then
printf '%sn' "account resolves"
else
printf '%sn' "account not found" >&2
exit 1
fiQuote the supplied name so shell metacharacters are not interpreted. This test asks NSS the same question as an interactive lookup and keeps the record itself out of the script’s normal output.
Save a reviewable snapshot
getent passwd > passwd-nss.txt
cut -d: -f1 /etc/passwd > passwd-local-names.txtLabel the files with their scope. Comparing a local-file snapshot with an NSS snapshot is meaningful only when you remember that the latter may include remote sources and may change as directory connectivity or membership changes.
Best Value
Troubleshoot surprising results
getent passwd shows more names than /etc/passwd
This normally means NSS is resolving accounts from one or more additional configured sources. Treat the difference as a scope distinction, not as corruption. Use the local-file command when you need only locally defined entries; use getent when the host’s effective identity view matters.
An expected directory user is missing
Check the exact spelling with getent passwd name. If it returns nothing, the configured NSS source may be unavailable, the account may not be in the permitted directory view, or the name may differ from the login identifier you were given. Review the host’s NSS and directory-service configuration with the administrator responsible for identity services.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A command lists nobody
An empty who or users result means there are no sessions visible to that command at that moment. It does not mean that the machine has no accounts. Run getent passwd or inspect /etc/passwd for account inventory.
The output contains service accounts
That is expected from a complete passwd enumeration. Linux services often need identities for file ownership and privilege separation. Use lslogins where available or a locally documented UID policy when you need a human-account view; do not delete entries merely because they are not interactive users.
The output is delayed or an enumeration appears incomplete
NSS may contact a remote identity service. Network reachability, authentication, directory filters, and service timeouts can affect a query. If your task is specifically a local inventory, read /etc/passwd directly. If your task is to establish what the operating system can resolve, investigate the NSS backend rather than silently substituting the local file.
Use the result responsibly
User listings can expose names, home paths, shells, and directory-backed identities. Store snapshots with appropriate permissions and avoid publishing them unnecessarily. A passwd record is descriptive account metadata, not proof that the account is enabled, currently used, or authorized for a particular application.
For an operational check, state the scope in your notes: “local passwd entries,” “NSS-resolved accounts,” or “active sessions.” That one label prevents a later reader from mistaking a session list for an account list or a local file for the complete identity database.
Quick Recap
A practical command checklist
- Need every account the host can resolve? Run
getent passwd. - Need only the resolved login names? Pipe it to
cut -d: -f1. - Need local accounts only? Run
cut -d: -f1 /etc/passwd. - Need one account lookup? Run
getent passwd username. - Need current sessions? Run
who; useusersfor names only. - Need human-oriented filtering? Use
lslogins -uwhere available, or follow the host’s documented UID policy instead of assuming a universal cutoff.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
