diff --git a/public/lib/accesslib.php b/public/lib/accesslib.php
index 3c6df9dfbc5..646fe1dfa04 100644
--- a/public/lib/accesslib.php
+++ b/public/lib/accesslib.php
@@ -3796,14 +3796,13 @@ function get_with_capability_join(context $context, $capability, $useridcolumn)
                                                           AND roleid IN (" . implode(',', array_keys($prohibited[$cap])) . "))";
 
                 } else {
-                    $unions[] = "SELECT userid
-                                   FROM {role_assignments}
-                                  WHERE contextid IN ($ctxids) AND roleid IN (" . implode(',', array_keys($needed[$cap])) . ")
-                                        AND userid NOT IN (
-                                            SELECT userid
-                                              FROM {role_assignments}
-                                             WHERE contextid IN ($ctxids)
-                                                   AND roleid IN (" . implode(',', array_keys($prohibited[$cap])) . "))";
+                    $unions[] = "SELECT ra.userid
+                                   FROM {role_assignments} ra
+                              LEFT JOIN {role_assignments} rap ON (rap.userid = ra.userid
+                                        AND rap.contextid IN ($ctxids)
+                                        AND rap.roleid IN (" . implode(',', array_keys($prohibited[$cap])) . "))
+                                  WHERE ra.contextid IN ($ctxids) AND ra.roleid IN (" . implode(',', array_keys($needed[$cap])) . ")
+                                        AND rap.id IS NULL";
                 }
             }
         }