4

I have a weird situation, where a user, whom should NOT have access to a specific account, was able to

  1. See it
  2. Change Account.

The account is set in US region, and the user is in Asia. We have region based roles hierarchy, and there is a distinction between both regions.

Looking on the account sharing rules, I do see that the user can have access, but the reason is not clear:

Can someone let me know what; administrator means on the "Reason for access" (the specific user is definitily not an admin

enter image description here

  • note: the second reason: Role: Asia Sales gives access, but this is only a sideeffect of the change (as the user changed ownership from a US owner, to a lower role asia owner)

User profile has NO View/edit all data

enter image description here

User does have Full Account edit, but I don't think it's that.

enter image description here

Here are the overrides for the account - is that the reason?

The user's profile is marked in red

enter image description here

Improve this question
3
  • 1
    Check the user's profile. Does he have see all data permissions?
    – Daniel Hoechst
    Jul 30, 2013 at 16:53
  • 1
    Can you post the sharing rule? And does the profile have View All for that object?
    – Mike Chale
    Jul 30, 2013 at 17:05
  • @MikeChale added overrides to Q
    – Saariko
    Jul 30, 2013 at 17:09

2 Answers 2

Reset to default
5

The profile has View All and Modify All for the object (Account) which is why it can see and change all of them.

Improve this answer
2
  • This seems crazy to sort now, but need to go over all my rules now. Thanks
    – Saariko
    Jul 30, 2013 at 17:31
  • Just to add to this. Administrator means that View All or Modify All is either in the Profile or a Permission Set. When I was looking at this issue in my organization, I found a Permission Set was adding the View All permission on the object. So be sure to check both the Profile assigned to the User and the Permission Sets assigned to the User as well.
    – Mayday
    May 9 at 16:43
2

Do you have any apex sharing rule defined for the org. The rowcause or reason field can have user defined values when using apex sharing. And as far as i know "Administrator" is not a system generated value for sharing tables.

Improve this answer
1
  • No apex rules in this org
    – Saariko
    Jul 30, 2013 at 19:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .