Verify the assigned home directory of all local interactive users is group-owned by that user's primary GID with the following command: Note: This may miss local interactive users that have been assigned a privileged UID. Evidence of interactive use may be obtained from a number of log files containing system logon information. The returned directory "/home/test" is used as an example. $ stat --format="%n: GID=%g (%G), UID=%u (%U), MODE=%0.4a" $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd) /home/test: GID=1001 (test), UID=1001 (test), MODE=0700 Check the user's primary group with the following command: $ grep $(grep -E '^test:' /etc/passwd | awk -F: '{print $4}') /etc/group test:x:1001: If the user home directory referenced in "/etc/passwd" is not group-owned by that user's primary GID (1001 in the above example) this is a finding.