diff --git a/management/univention-directory-manager-modules/modules/univention/admin/handlers/shares/share.py b/management/univention-directory-manager-modules/modules/univention/admin/handlers/shares/share.py
index dea6103..9338491 100644
--- a/management/univention-directory-manager-modules/modules/univention/admin/handlers/shares/share.py
+++ b/management/univention-directory-manager-modules/modules/univention/admin/handlers/shares/share.py
@@ -482,7 +482,7 @@ class cscPolicy(univention.admin.syntax.select):
 			short_description=_('Valid users or groups'),
 			long_description='',
 			syntax=univention.admin.syntax.string,
-			multivalue=0,
+			multivalue=1,
 			options=['samba'],
 			required=0,
 			may_change=1,
@@ -492,7 +492,7 @@ class cscPolicy(univention.admin.syntax.select):
 			short_description=_('Invalid users or groups'),
 			long_description='',
 			syntax=univention.admin.syntax.string,
-			multivalue=0,
+			multivalue=1,
 			options=['samba'],
 			required=0,
 			may_change=1,
@@ -734,6 +734,18 @@ def unmapKeyAndValue(old):
 	return lst
 
 
+def unmapSambaShareUsers(value):
+	if not value:
+		return []
+	value = value[0]
+	p = re.compile(',(?=(?:[^"]*"[^"]*")*[^"]*$)')
+	return [x[1:-1].replace('\\"', '"') if x.startswith('"') and x.endswith('"') else x for x in map(str.strip, p.split(value))]
+
+
+def mapSambaShareUsers(value):
+	return ', '.join('"%s"' % (v.replace('"', '\"'),) if ' ' in v else v for v in value)
+
+
 def insertQuotes(value):
 	'Turns @group name, user name into @"group name", "user name"'
 
@@ -789,8 +801,8 @@ def insertQuotes(value):
 mapping.register('sambaFakeOplocks', 'univentionShareSambaFakeOplocks', None, univention.admin.mapping.ListToString)
 mapping.register('sambaBlockSize', 'univentionShareSambaBlockSize', None, univention.admin.mapping.ListToString)
 mapping.register('sambaCscPolicy', 'univentionShareSambaCscPolicy', None, univention.admin.mapping.ListToString)
-mapping.register('sambaValidUsers', 'univentionShareSambaValidUsers', None, univention.admin.mapping.ListToString )
-mapping.register('sambaInvalidUsers', 'univentionShareSambaInvalidUsers', None, univention.admin.mapping.ListToString )
+mapping.register('sambaValidUsers', 'univentionShareSambaValidUsers', mapSambaShareUsers, unmapSambaShareUsers)
+mapping.register('sambaInvalidUsers', 'univentionShareSambaInvalidUsers', mapSambaShareUsers, unmapSambaShareUsers)
 mapping.register('sambaHostsAllow', 'univentionShareSambaHostsAllow' )
 mapping.register('sambaHostsDeny', 'univentionShareSambaHostsDeny' )
 mapping.register('sambaForceUser', 'univentionShareSambaForceUser', None, univention.admin.mapping.ListToString)