diff --git a/services/univention-s4-connector/modules/univention/s4connector/s4/__init__.py b/services/univention-s4-connector/modules/univention/s4connector/s4/__init__.py
index 1a78fa437f..f2f7ff4892 100644
--- a/services/univention-s4-connector/modules/univention/s4connector/s4/__init__.py
+++ b/services/univention-s4-connector/modules/univention/s4connector/s4/__init__.py
@@ -38,6 +38,7 @@ import copy
 import string
 import re
 import sys
+import calendar
 import time
 import types
 import pprint
@@ -239,12 +237,12 @@ def encode_s4_resultlist(s4_resultlist):
 
 def unix2s4_time(l):
 	d = 116444736000000000  # difference between 1601 and 1970
-	return int(time.mktime(time.gmtime(time.mktime(time.strptime(l, "%Y-%m-%d")) + 90000))) * 10000000 + d  # 90000s are one day and one hour
+	return int(calendar.timegm(time.gmtime(calendar.timegm(time.strptime(l, "%Y-%m-%d")) - 86400))) * 10000000 + d  # AD stores end of day in accountExpires
 
 
 def s42unix_time(l):
 	d = 116444736000000000  # difference between 1601 and 1970
-	return time.strftime("%d.%m.%y", time.gmtime((l - d) / 10000000))
+	return time.strftime("%d.%m.%y", time.gmtime((l - d) / 10000000 + 86400)) # shadowExpire treats day of expiry as exclusive
 
 
 def samba2s4_time(l):