diff --git services/univention-ad-connector/modules/univention/connector/ad/__init__.py services/univention-ad-connector/modules/univention/connector/ad/__init__.py
index 663f10fe69..b341863639 100644
--- services/univention-ad-connector/modules/univention/connector/ad/__init__.py
+++ services/univention-ad-connector/modules/univention/connector/ad/__init__.py
@@ -38,6 +38,7 @@ import ldap
 import sys
 import base64
 import time
+import calendar
 import os
 import copy
 import types
@@ -262,12 +263,12 @@ def encode_ad_resultlist(ad_resultlist):
 
 def unix2ad_time(l):
 	d = 116444736000000000  # difference between 1601 and 1970
-	return int(time.mktime(time.gmtime(time.mktime(time.strptime(l, "%Y-%m-%d")) + 90000))) * 10000000 + d  # 90000s are one day and one hour
+	return int(calendar.timegm(time.strptime(l, "%Y-%m-%d")) - 86400) * 10000000 + d  # AD stores end of day in accountExpires
 
 
 def ad2unix_time(l):
 	d = 116444736000000000  # difference between 1601 and 1970
-	return time.strftime("%d.%m.%y", time.gmtime((l - d) / 10000000))
+	return time.strftime("%Y-%m-%d", time.gmtime((l - d) / 10000000 + 86400))  # shadowExpire treats day of expiry as exclusive
 
 
 def samba2ad_time(l):