The default "admin" account is still in use

What the audit found

Your configuration still contains the built-in admin user with the full group. This is the account every RouterOS device ships with, and it is the one still being used for management on your router.

The audit reports this as medium severity. On its own, an account named admin with a strong password is not a hole. The problem is that it turns every password-guessing attempt into a one-variable problem, and that it is usually combined with other findings — a management service reachable from the internet, or a password that is not as strong as it should be.

Why it matters

Brute-force attacks against routers are not sophisticated. Automated tools connect to Winbox, SSH, the web interface or the API and try combinations of user names and passwords. Since almost every MikroTik has an admin user, the tools do not bother guessing the name: they try admin with thousands of passwords, around the clock, from many addresses.

If your account is called something else, that entire effort is wasted. The attacker first has to guess the user name, and RouterOS gives no hint whether the name or the password was wrong. A unique name combined with a strong password puts a successful guess out of practical reach.

There is a second, quieter benefit. When several people manage a router, everyone logging in as admin means the log cannot tell you who did what. Personal accounts give you that answer and let you remove one person's access without changing the password everybody else uses.

Be honest about scale: renaming admin will not stop a determined attacker who has found a vulnerability, and it does nothing if the password is admin123. It is one layer of a defence — a cheap and effective one — alongside strong passwords and keeping management off the internet.

What it looks like in Winbox

Open System → Users. On the Users tab you will see a row named admin in group full. If that is the only full-access account, or the one you log in with, this is the finding. The Last Logged In column shows how recently it was used.

How to fix it

First create your own account with full rights under System → Users. Pick a name that is not obvious (jsmith-net, not administrator), put it in the full group, and give it a long password.

Then — and this is the important part — log out and log back in with the new account before you touch admin. Once you have confirmed the new login works, disable the old account rather than removing it: it stays in the list as a record but can no longer be used, and you can remove it later once you are confident nothing else depends on it.

Use Safe Mode for the second step. If you mistyped the new account's password and then disable admin, Safe Mode returns the router to the previous state when your session drops, instead of leaving you locked out. While you are on this screen, consider restricting full-access users to your management network with the Allowed Address field, so a leaked password still cannot be used from the internet.

Afterwards, the user list should show admin with the disabled flag and your new account in group full; a Winbox login as admin should be refused, while the new account can change settings. Then re-run the audit.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

Won't attackers just guess my new name too?

They may try common ones, which is why administrator, root, mikrotik and your company name are poor choices. A name that combines something personal with something unusual is not on any word list. Combined with a strong password and a management interface that is not reachable from the internet, the guessing problem becomes practically unsolvable.

Can I just rename the admin account instead?

Yes — renaming the account in System → Users works and keeps the password. Creating a separate account first is slightly safer because you verify the new login before removing the old one, but either approach ends in the same place.

Do scripts or monitoring tools depend on the admin user?

Check anything that logs in to the router automatically: backup scripts, monitoring via the API, the MikroTik mobile app. Give each its own account, ideally in a restricted group, and update their stored credentials before disabling admin.