--- a/base/univention-system-activation/debian/univention-system-activation.postrm	
+++ a/base/univention-system-activation/debian/univention-system-activation.postrm	
@@ -32,15 +32,4 @@ 
 
 #DEBHELPER#
 
-# allow root login again
-ucr unset --force auth/gdm/user/root \
-				auth/kdm/user/root \
-				auth/login/user/root \
-				auth/other/user/root \
-				auth/sshd/user/root
-
-# reset su restrictions
-ucr unset --force auth/su/restrict \
-				auth/su/user/root
-
 exit 0
--- a/base/univention-system-activation/debian/univention-system-activation.prerm	
+++ a/base/univention-system-activation/debian/univention-system-activation.prerm	
@@ -37,6 +37,8 @@ case "$1" in
 		# if package configuration is active, deactivate it
 		if [ -n "$apache2_system_activation_sites" ]; then
 			/usr/sbin/univention-system-activation stop
+		else
+			/usr/sbin/univention-system-activation allow-root
 		fi
 		;;
 
--- a/base/univention-system-activation/scripts/univention-system-activation	
+++ a/base/univention-system-activation/scripts/univention-system-activation	
@@ -50,8 +50,11 @@ function allow_root_login() {
 		auth/su/user/root
 
 	# some values were not set during the pam installation, because they were set
-	# in the force layer. Reconfigure pam
-	dpkg -l univention-pam > /dev/null 2>&1 && dpkg-reconfigure univention-pam
+	# in the force layer. Reconfigure PAM if no other dpkg process is running
+	# (e.g., when "stop" is called in the postrm script).
+	fuser /var/lib/dpkg/lock >/dev/null 2>&1 \
+		|| dpkg -l univention-pam > /dev/null 2>&1 \
+		&& dpkg-reconfigure univention-pam
 }
 
 function restrict_root_login() {