diff --git a/admin/cron.php b/admin/cron.php
index 7548e89a8fb..77f73bdbfeb 100644
--- a/admin/cron.php
+++ b/admin/cron.php
@@ -117,13 +117,27 @@
 
         }
     }
-    mtrace("Finished blocks");
+    mtrace('Finished blocks');
 
     if (!empty($CFG->langcache)) {
         mtrace('Updating languages cache');
         get_list_of_languages();
     }
 
+    mtrace('Removing expired enrolments ...', '');     // See MDL-8785
+    $timenow = time();
+    if ($oldenrolments = get_records_select('role_assignments', "timeend > 0 AND timeend < '$timenow'")) {
+        mtrace(count($oldenrolments).' to delete');
+        foreach ($oldenrolments as $oldenrolment) {
+            if (role_unassign($oldenrolment->roleid, $oldenrolment->userid, 0, $oldenrolment->contextid)) {
+                mtrace("Deleted expired role assignment $oldenrolment->roleid for user $oldenrolment->userid from context $oldenrolment->contextid");
+            }
+        }
+        mtrace('Done');
+    } else {
+        mtrace('none found');
+    }
+
 
 /// Run all core cron jobs, but not every time since they aren't too important.
 /// These don't have a timer to reduce load, so we'll use a random number 
diff --git a/lib/accesslib.php b/lib/accesslib.php
index 80bba906f64..214818ecfa6 100755
--- a/lib/accesslib.php
+++ b/lib/accesslib.php
@@ -738,9 +738,7 @@ function load_user_capability($capability='', $context = NULL, $userid='') {
         $capsearch ="";
     }
 
-/// Set up SQL fragments for timestart, timeend etc
     $now = time();
-    $timesql = "AND ((ra.timestart = 0 OR ra.timestart < $now) AND (ra.timeend = 0 OR ra.timeend > $now))";
 
 /// Then we use 1 giant SQL to bring out all relevant capabilities.
 /// The first part gets the capabilities of orginal role.
@@ -763,7 +761,6 @@ function load_user_capability($capability='', $context = NULL, $userid='') {
                      $searchcontexts1
                      rc.contextid=$siteinstance->id
                      $capsearch
-                     $timesql
               GROUP BY
                      rc.capability, (c1.contextlevel * 100), c1.id
                      HAVING
@@ -810,7 +807,6 @@ function load_user_capability($capability='', $context = NULL, $userid='') {
                      $searchcontexts1
                      rc.contextid != $siteinstance->id
                      $capsearch
-                     $timesql
 
               GROUP BY
                      rc.capability, (c1.contextlevel * 100 + c2.contextlevel), c1.id, c2.id, rc.permission