[Samba] Am I going about this all the wrong way?

[David Greenhall]

Sorry for the title, but couldnt think how to word it.
 
Basically we have a piece of software that all departments in our company uses, placed on the samba server but runs from windows. Because different departments use other items on the server which will differ depending on who needs them this is what i have done:
 
       [AccountsFolder] |---------------[SymbolicLink1] - Linked to folder1/softwarefolder
 
[folder1] - Contains the software for all
    |-------[Softwarefolder]
 
       [SalesFolder] |---------------[SymbolicLink2] - Linked to folder1/softwarefolder
 
The Folder1 is owned by domain admins
AccountsFolder owned by Accounts
and Salesfolder owned by Sales.
 
[smb.conf]
 
[Accounts]
 browseable = no
 inherit permissions = Yes
 delete readonly = Yes
 writeable = yes
 valid users = @Accounts
 path = /var/samba/Accounts
 force group = Accounts
 
[Sales]
 browseable = no
 inherit permissions = Yes
 delete readonly = Yes
 writeable = yes
 valid users = @Sales
 path = /var/samba/Sales
 force group = Sales
 
However, when i check the connections using webmin, there are users in accounts who have connections open from sales and visa versa. This I was hoping someone could enlighten me on. I cannot figure out how they can gain access to a share that they have no permissions to open. When I browse from their machines to try and open the other shares its as you would expect [Access Denied] 
 
So basically im wondering if i am going about this all the wrong way, and maybe someone could hint at a better way.
 
Thanks
Dave
 
___________________
Systems Administrator
Praybourne Limited
 
Tel: +44 (0) 870 2420004
Fax: +44 (0) 1527 68780