diff --git a/enrol/manual/lib.php b/enrol/manual/lib.php
index e13033a09e5..10e12e1e4b0 100644
--- a/enrol/manual/lib.php
+++ b/enrol/manual/lib.php
@@ -358,9 +358,12 @@ class enrol_manual_plugin extends enrol_plugin {
                 if ($action == ENROL_EXT_REMOVED_SUSPENDNOROLES) {
                     // Remove all manually assigned roles here, this may break enrol_self roles but we do not want hardcoded hacks here.
                     role_unassign_all(array('userid'=>$ue->userid, 'contextid'=>$ue->contextid, 'component'=>'', 'itemid'=>0), true);
+                    $this->update_user_enrol($instance, $ue->userid, ENROL_USER_SUSPENDED);
+                    $trace->output("suspending expired user $ue->userid in course $instance->courseid, roles unassigned", 1);
+                } else {
+                    $this->update_user_enrol($instance, $ue->userid, ENROL_USER_SUSPENDED);
+                    $trace->output("suspending expired user $ue->userid in course $instance->courseid, roles kept", 1);
                 }
-                $this->update_user_enrol($instance, $ue->userid, ENROL_USER_SUSPENDED);
-                $trace->output("suspending expired user $ue->userid in course $instance->courseid", 1);
             }
             $rs->close();
             unset($instances);