Log in to the FortiGate GUI with Super-Admin privilege. First, set one admin profile with access to System Maintenance. 1. Click System. 2. Click Admin Profiles. 3. Click +Create New (Admin Profile). 4. Assign a meaningful name to the Profile. 5. Set System Access Permissions to Read/Write or Custom with Maintenance set to Read/Write. 6. Click OK to save this Profile. Then, 1. Click System. 2. Click Administrators. 3. Click +Create New (Administrator). 4. Configure Administrator settings with unique Username, Type, and Password. 5. Assign the Administrator Profile that was configured above. 6. Click OK to save. Note: Do not assign this admin profile to any other users other than the authorized administrator. To limit the System access to existing low-privilege administrators: 1. Click System. 2. Click Administrators. 3. Identify the admin role that has unauthorized access to System settings. 4. Select the admin role and hover over the profile assigned to the role. 5. Click Edit. 6. On System access permission, click Read or None. 7. Click OK to save. Repeat this process to define all the Administrators needed to meet privilege separation requirements for the organization. or 1. Open a CLI console, via SSH or available from the GUI 2. First edit the admin profile by running the following command: # config system accprofile # edit {PROFILE NAME} # set sysgrp read or none # next # end Then, assign this admin profile to the authorized administrator account. # config system admin # edit {ADMIN NAME} # set accprofile {PROFILE NAME} # next # end Note: Do not assign this admin profile to any other users other than the authorized administrator.