Profiles, Roles, Security Settings and how they're not working.

[DeMan]

I just created an account to move one of our portal users to a Salesforce user. I tested out her profile and security settings perfectly in sandbox. However after checking the same settings in production, I noticed that many of the accounts that should not have been visible (as we deal with sensitive EMR data) were in fact visible. My security settings seem to partially work, as only a small fraction of accounts are available, yet these elusive handful of accounts still remain accessible. 

Is there any chance my settings are being overridden? I've checked all my other Sharing Settings and can't find a conflict. Or is my production simply broken? I don't believe it's a hierarchy issue either as this particular role is on the bottom of the heap. Any advice or answers on how to deal with this problem would be much appreciated

[laks]

Hi, Is the "Modify All Data" permission enabled under System Permissions for that Profile ? Not sure whether this will be of help. But I had a problem with some data being always visible whatever sharing setting was applied & the reason was that the above was enabled for that Profile. Regards, Lakshmi.

[DeMan]

Thanks for the response, but unchecking 'Modify all Data', and 'View all Data' were the first things I did. They are also disabled under object settings as well. Plus I don't think it's a 'View all' problem' as it's only some data I can see.

[DeMan · Accepted solution]

Woot, Woot.

The answer was in my Sharing settings. I had leads visible to 'All Internal Users' this overrode my other settings. To overcome this I created a new group called Internal Users where I excluded the new account.

Maybe not the most elegant solution, but it works.