I was having trouble finding a role that worked for a co-worker so I gave them Admin. Now I want to take it away but I can't.
I added another AD group and am trying to assign Admin to a user in that group but it wont let me.
Make sure to look at what AD groups the person is in. It sounds like they are in a group that you mapped and that would be why you can''t delete them from Splunk.
I should check in map groups what is mapped to the admin role. On the right side you can see the role the group has. In the left column it shows the AD group. You can click on the AD group to see who is in that group.
Hope this helps.