I've removed him from the group

Hello @yana7 ,

It seems that Dedy has a group, have you checked if that group is the one containing the role?

Regards,

Zack

the group had no role

Hi @yana7 

As per best practice,   a role never assigned to a user directly , and in same line when you want to remove the role, remove the role from group first and then it will get removed from user profile. 

HI @yana7

If you have the "Contextual Security: Role Management V2" plugin activated (activated on instances for some time now). Then there is a fix script Servcenow Support can run to identify any inheritance errors, and correct that aspect. If you don't have that plugin, activate it.

 If a role was added to a user directly (not best practice as stated above) then admin user should be able to delete the record.  Once the sys_user_has_role table has been cleaned up, avoid adding roles directly (although still possible) and do that using groups. for sys_user_has_role records you can add the 'Inheritance map' column to a list view and see how that user inherited the role.