NTP time synchronisation is not configured
Your router does not synchronise its clock. Most MikroTik devices have no battery-backed clock, so after every reboot the time starts from a fixed date. Certificates then fail to validate and logs become useless for working out what happened when.
/system ntp client
What the audit found
The NTP client (System → NTP Client) is not enabled, and no other time source (such as MikroTik Cloud, which sets the clock as a side effect) is configured. The router's clock is therefore whatever it was set to manually — or, after a reboot, a default date years in the past.
The audit reports this as informational. A wrong clock is not a way in for an attacker; it is a hygiene issue that quietly undermines other things — certificate validation, log timestamps, scheduled tasks — and it costs two commands to fix.
Why it matters
This is not a hole, so keep the scale in mind. But it is one of those settings whose absence causes confusing problems elsewhere.
Most MikroTik hardware has no real-time clock with a battery. When the router boots, the time starts from a fixed date until something sets it. Without NTP, "something" never happens.
Certificates are the first casualty. TLS certificates have a validity window; if the router believes it is 1970 or 2010, every certificate it checks appears to be not yet valid. That affects HTTPS connections the router makes (fetching updates, Let's Encrypt renewal, cloud services), IPsec and OpenVPN peers that authenticate with certificates, and RADIUS over TLS. The error messages rarely say "your clock is wrong".
Logs are the second. When you are trying to work out whether a router was compromised, or why a link dropped, the log timestamps are the timeline. If the router's clock is wrong — or resets on each reboot — you cannot line up its log against the firewall, the switch or your monitoring system. An incident that took place "at 03:14 on 1 January 1970" tells you nothing.
Scheduled scripts, time-based firewall rules, DHCP lease bookkeeping and the Last Logged In column all depend on the same clock.
What it looks like in Winbox
Open System → NTP Client. If Enabled is unticked and no servers are listed, this is the finding. System → Clock shows the current time and date the router believes; a date years in the past is the giveaway.
How to fix it
The fix is to enable the NTP client and give it at least one server. Under System → NTP Client, tick Enabled and add a time source in the Servers list — a public pool such as pool.ntp.org, or better, an NTP server run by your ISP or on your own network, which is closer and does not depend on external DNS working at boot. Add more than one server so a single outage does not leave the clock unset. On RouterOS 6 the dialog has Primary and Secondary fields that take IP addresses rather than host names.
While you are there, set the time zone under System → Clock so that log timestamps display in local time. Make sure DNS resolution works on the router (IP → DNS) and that the firewall allows outgoing UDP 123, otherwise the client cannot reach the pool. Enabling NTP has no effect on management access, so Safe Mode is not needed.
Afterwards, wait a minute and open System → NTP Client again: the status should show synchronized and name the server it used, and System → Clock should show the correct date and time. Reboot the router if you want to be certain it recovers the time on its own. Then re-run the audit.
The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.
FAQ
The router is a client of MikroTik Cloud. Doesn't that set the time?
Yes — when Cloud DDNS is enabled the router gets its time from MikroTik's servers, and the audit does not report this finding in that case. NTP is still the better source: it is more accurate, does not depend on a single vendor service, and works on networks that block cloud access.
Should the router also serve NTP to my LAN?
It can (System → NTP Server on RouterOS 7, or the separate ntp package on 6). Serving time to internal devices is useful, but only after the router itself is synchronised. Do not enable the server on the WAN side.
Is a wrong clock really a security issue?
Not by itself, which is why the finding is informational. It becomes one indirectly: expired-certificate errors tempt people to disable certificate checking, and logs without reliable timestamps make an intrusion harder to investigate. Two commands remove both problems.
This article explains the finding in general terms. Test any configuration change with Safe Mode enabled in Winbox. MKRouterKit analyses configuration exports only; it does not replace an external port scan or a professional penetration test.