awk — User & Group Analysis

List real users (UID >= 1000)

awk -F: '$3>=1000 && $3<65534 {print $1, $3, $7}' /etc/passwd

Users with bash shell

awk -F: '$7 ~ /bash/ {print $1}' /etc/passwd

Service accounts — nologin or false shell

awk -F: '$7 ~ /nologin|false/ {print $1}' /etc/passwd

List group members for a specific group

awk -F: '/^wheel:/{print $4}' /etc/group

Groups with members, sorted by member count

awk -F: '$4!="" {n=split($4,a,","); print n, $1": "$4}' /etc/group | sort -rn

Count users per login shell

awk -F: '{shells[$7]++} END{for(s in shells) print shells[s], s}' /etc/passwd | sort -rn

Accounts with password never expires

sudo awk -F: '$5=="" || $5==99999 {print $1}' /etc/shadow

Locked accounts (! or * in password hash)

sudo awk -F: '$2 ~ /^[!*]/ {print $1}' /etc/shadow

Home directories that exist on disk

awk -F: '$6 ~ /^\/home/ {print $6}' /etc/passwd | while read d; do [[ -d "$d" ]] && echo "$d"; done