Have a number of read only users, that appear to all be setup the same way, though one of the users is somehow being logged as the user for the last-modified date on the contact. Again, checked the user configs and as far as I am able to tell, they're exactly the same except for the user related data such as Name, Alias, Email, Username, Nickname, etc.

Any suggestions about how to track down both what Salesforce believes was changed, and why this user, and only this user is being logged to the last-modified date on contacts?

UPDATE: Finally, after clicking around, and around, I found something, and in fact, appears to be something that the answer below might have suggested as the source; though indirectly, sense it appears to be code from the NPSP that's the source of the issue. Selected the answer below as the answer, and posted a new question here: How to find/stop/disable Apex Jobs that a read-only user has activated

  • To get to the bottom of this issue, you will need to recreate the problem. Judging by the comments under one of the answers here, you don't know exactly when this is happening for sure, and so it's going to be difficult to solve. If you can come up with some steps that consistently cause the update, we will be closer to the answer. Also, do you have any third-party apps installed, other than the Non-Profit Starter Pack? May 22, 2014 at 2:08
  • @JeremyNottingham: No, nothing else has been installed by me on SF, and I'm the only non-read-only user currently; this is going to change, but at this point, troubled that somehow a read-only user was able to be logged as doing something. As for the timing, believe I've got it down to an exact time, but no event to tie it to; 1000s of contacts were had their last-mod-date updated within 2-minutes on May 20th, though it was not all the records. If you have any questions or suggestions, let me know. Thanks!
    – blunders
    May 22, 2014 at 11:31
  • My only suggestion at this point is to try to get a sequence of steps that causes this to happen, and then observe the process. You still don't know when it's happening, so you won't be able to determine why. May 22, 2014 at 11:36
  • @JeremyNottingham: Meaning that unless the user is able to roughly recall what they did and reproduce it, then there's zero info logged in SF by default on EE that might give a clue to how/why 1000s of files now have a last-mod-date updated to the user's name, right, or am I missing something?
    – blunders
    May 22, 2014 at 13:51

1 Answer 1


In no particular order...

  • Time-based workflows with one of these guys as "default running user"?
  • batch jobs scheduled as one of these guys (Apex will run in system mode and unless the code explicitly checks the permissions - "impossible is nothing").
  • Integrations? Check the users' login history maybe? Pay attention to IP, login times, the application type...
  • Sites? Do you have anything exposed as Web-to-Lead for example?
  • Inbound email handlers configured to run under this user?
  • Do you use "Salesforce to Salesforce"?

As for tracking...

  • deactivate them and wait for fireworks :P
  • setup field history tracking on fields you consider important?
  • Thank you; just checked, and none the reasons listed appear to apply to me, it might help someone else if they happen to run across this. All the current contacts were bulk loaded; it's a single user; noting unusual in the access logs; beyond being given a read-only user (Profile = Read Only); their user has not been used for anything else by me, the only non-read-only user currently; bit at a loss, and it's concerning that a read-only user is being listed as doing something and neither they or I have any reason to believe they're "modified" anything.
    – blunders
    May 21, 2014 at 23:03
  • Any rate, thanks, and if you have any other suggestions, just post a comment so that I'm aware of anything you post; updates to the answer won't ping me for some reason.
    – blunders
    May 21, 2014 at 23:03
  • Most interesting. How about setting up a workflow rule + email alert "every time record is created or edited" to yourself, make the workflow's firing condition a formula with value of 'true'?
    – eyescream
    May 21, 2014 at 23:09
  • Aside from a ping that something happened, would the change (before & after) be listed in the email with the user's name and the record-id? If not, might be useful, though not exactly sure how much additional information it might give to track down what is going on. Thanks!
    – blunders
    May 21, 2014 at 23:15
  • 1
    Finally, after clicking around, and around, I found something, and in fact, appears to be something you might have suggested as the source. Selected your answer above as the answer, and posted a new question here: How to find/stop/disable Apex Jobs that a read-only user has activated
    – blunders
    May 22, 2014 at 15:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .