OWD is set to Private for Accounts object. A lower level user can see accounts they don't own. How do I stop that happening?

Question

I have two users - one is an Administrator and the other a Sales rep. I want the Sales rep to only have full access to his accounts, leads, contacts. I want the Administrator to have full access to everything on the system. I have used OWD and set the access to Private for Accounts, Leads, Contacts. However, the rep can still access accounts that don't belong to him. How do I stop that happening?

Answer 1

To answer this question you will need to answer yourself three questions

1)Have you set up a Role Hirerachy and whats the role of Sales Rep in the role hierarchy ?If your reps are higher than some of roles then even keeping it private will allow access as for standard profiles Grant Access Using Hirerachy Checkbox is always checked and you cant modify

2)Is the profiles of sales rep has Modify All Data or view All Data checked ?This will allow to view irrespective of sharing rules set.

3)Check the permission sets assigned to the User .Permission sets may have granted additional access as well

One way to figure exact cause will be query AccountShare Record with AccountId as Account that Rep should not have access and User Id as the User Id of the REP.This way share records will tell you what process giving you extra access to records

Answer 2

Check the role hierarchy and Profile setting.

https://help.salesforce.com/HTViewHelpDoc?id=security_controlling_access_using_hierarchies.htm&language=en_US

https://help.salesforce.com/HTViewHelpDoc?id=users_profiles_view_all_mod_all.htm&language=en_US