The Accounts the Panel Does Not Show

Not every account appears in Settings

The Users panel shows normal people. Some accounts are deliberately set up so they do not appear there, and one of them can have complete control of the machine.

Open the account file

sudo nano /etc/passwd

One line per account. The third item on each line is the power level, and 0 means complete control:

root:x:0:0:root:/root:/bin/bash
 │     │
 │     └── 0 = full control of the machine
 └──────── the name, which tells you nothing

Read down the file and look at that third item. Exactly one line should have a 0, and it should be root. A second one is a finding worth points.

Leave with Ctrl+X without changing anything.

There is a faster way to ask the same question:

awk -F: '$3==0 {print $1}' /etc/passwd

That prints only the names with a power level of 0. You want one line back. If you get two, the second one is your finding.

Why this one matters so much

An account like this does not show up in the Users panel, is not in the administrators group, and does not need to ask for permission to do anything. An audit that only looks at Settings misses it completely.

Removing it

Start with the obvious command:

sudo userdel NAME

On this kind of account it will almost certainly refuse:

userdel: user NAME is currently used by process 1

That error is confirmation you found the right thing. userdel looks for running processes by power level, not by name. This account shares root's power level, so everything root is running looks like it belongs to this account, including process 1, which is the first thing the system starts and can never be stopped.

Force it through, then remove the group it leaves behind:

sudo userdel -f NAME
sudo groupdel NAME

The second command matters. Deleting an account leaves its group sitting in /etc/group, and a leftover group causes problems later.

Check your work:

awk -F: '$3==0 {print $1}' /etc/passwd

Only root should come back.

💡 Never add -r to that command. -r means "delete their home folder too", and an account like this is sometimes pointed at a real system folder. If you want to know where it points before you touch it, read the line first with grep NAME /etc/passwd. Without -r the account goes and nothing else is touched, which is what you want.

Try it yourself

awk -F: '$3==0 {print $1}' /etc/passwd    # how many names come back?

If there are two, you have found points.