Margaret,

>I have the MM user, belonging to no group, with full access to all bars.
>I have another user DW, belonging to group accounting, with read-only access to all bars and full access to the payroll bar.>

The "no access" strategy specifies that if you don't specify anything specifically for a user that user has no access to any "secure" application objects. Have you specified "full access" for the MM user?

Regards,