Delete default admin on FortiManager, FortiAuthenticator, FortiAnalyzer and FortiClientEMS

[cpx]

We would like to delete the default admin accounts on FortiManager, FortiAuthenticator, FortiAnalyzer and FortiClientEMS and replace them with another generic account for security reasons.

Is it safe for all these systems to delete the default user admin? For FortiManager and FortiAuthenticator I can see inside the logs that there are some actions performed by the admin user internally from the system. So I would like to ensure that deleting the account won't break something.

Kind reagards

[dingjerry_FTNT · Accepted solution]

Hi @cpx ,

As long as the "Delete" option is available for those default admin accounts, yes, it's OK for you to delete them.

[cpx]

Hi dingjerry_FTNT,

thanks for you response. I will have a look into this. For FortiAnalyzer and FortiManager the option is not available from gui but the administration guide states that it is possible from cli. So I sounds like a viable option. I will check this.

Kind regards

[dingjerry_FTNT]

Hi @cpx ,

I just did a quick test on my lab FMG:

1) In the GUI, when I selected the "admin" account, the "Delete" button was greyed out;  No matter whether I logged in with the "admin" account or not.

2) In CLI, I could delete the "admin" account while logging in with another "super_user" account.

[cpx]

Hi dingjerry_FTNT,

thank you for this. I was able to delete the default admin user on

1. FortiManager via CLI

2. FortiAnalyzer via CLI

3. FortiAuthenticator via GUI

For FortiClientEMS I get an error that deletion failed on gui.

I found this in FortiClient EMS Administration Guide:

The built-in admin user account is always active. Allowed inactive days does not affect the admin account.

So I guess the admin cannot be deleted.

Kind Regards