diff --git a/management/univention-directory-manager-modules/modules/univention/admin/handlers/users/user.py b/management/univention-directory-manager-modules/modules/univention/admin/handlers/users/user.py
index ef32260..67b1ce5 100644
--- a/management/univention-directory-manager-modules/modules/univention/admin/handlers/users/user.py
+++ b/management/univention-directory-manager-modules/modules/univention/admin/handlers/users/user.py
@@ -2223,6 +2223,7 @@ def _ldap_modlist(self):
 
 				old_shadowMax=self.oldattr.get('shadowMax', '')
 				if old_shadowMax != shadowMax:
+					ml = [x for x in ml if x[0] != 'shadowMax']
 					ml.append(('shadowMax',self.oldattr.get('shadowMax', [''])[0], shadowMax))
 
 			if 'samba' in self.options:
@@ -2236,6 +2237,7 @@ def _ldap_modlist(self):
 				univention.debug.debug(univention.debug.ADMIN, univention.debug.INFO, 'krb5PasswordEnd: %s' % krb5PasswordEnd)
 				old_krb5PasswordEnd=self.oldattr.get('krb5PasswordEnd', '')
 				if old_krb5PasswordEnd != krb5PasswordEnd:
+					ml = [x for x in ml if x[0] != 'krb5PasswordEnd']
 					ml.append(('krb5PasswordEnd',self.oldattr.get('krb5PasswordEnd', [''])[0], krb5PasswordEnd))
 		elif pwd_change_next_login == 2:	# pwdChangeNextLogin changed from 1 to 0
 			# 1. determine expiryInterval (could be done once before "if self.modifypassword" above)
@@ -2263,6 +2265,7 @@ def _ldap_modlist(self):
 				univention.debug.debug(univention.debug.ADMIN, univention.debug.INFO, 'shadowMax: %s' % shadowMax)
 				old_shadowMax=self.oldattr.get('shadowMax', [''])[0]
 				if old_shadowMax != shadowMax:
+					ml = [x for x in ml if x[0] != 'shadowMax']
 					ml.append(('shadowMax', old_shadowMax, shadowMax))
 
 			# 3. set samba attributes
@@ -2281,6 +2284,7 @@ def _ldap_modlist(self):
 				univention.debug.debug(univention.debug.ADMIN, univention.debug.INFO, 'krb5PasswordEnd: %s' % krb5PasswordEnd)
 				old_krb5PasswordEnd=self.oldattr.get('krb5PasswordEnd', [''])[0]
 				if old_krb5PasswordEnd != krb5PasswordEnd:
+					ml = [x for x in ml if x[0] != 'krb5PasswordEnd']
 					ml.append(('krb5PasswordEnd',old_krb5PasswordEnd, krb5PasswordEnd))