--- management/univention-directory-manager-modules/modules/univention/admin/de.po	
+++ management/univention-directory-manager-modules/modules/univention/admin/de.po	
@@ -1675,6 +1675,9 @@ msgstr ""
 "Ziffer oder einem Buchstaben beginnen und enden, und darf nicht \"admin\" "
 "sein."
 
+msgid "Value out of bounds (%d - %d seconds)"
+msgstr "Wert außerhalb des erlaubten Bereichs (%d - %d Sekunden)."
+
 #: modules/univention/admin/uexceptions.py:84
 msgid "Values do not match."
 msgstr "Die Werte sind nicht gleich."
--- management/univention-directory-manager-modules/modules/univention/admin/handlers/settings/sambadomain.py	
+++ management/univention-directory-manager-modules/modules/univention/admin/handlers/settings/sambadomain.py	
@@ -145,7 +145,7 @@ property_descriptions={
 	'minPasswordAge': univention.admin.property(
 			short_description=_('Minimum password age'),
 			long_description='',
-			syntax=univention.admin.syntax.UNIX_TimeInterval,
+			syntax=univention.admin.syntax.SambaMinPwdAge,
 			multivalue=0,
 			options=[],
 			required=0,
@@ -175,7 +175,7 @@ property_descriptions={
 	'maxPasswordAge': univention.admin.property(
 			short_description=_('Maximum password age'),
 			long_description='',
-			syntax=univention.admin.syntax.UNIX_TimeInterval,
+			syntax=univention.admin.syntax.SambaMaxPwdAge,
 			multivalue=0,
 			options=[],
 			required=0,
--- management/univention-directory-manager-modules/modules/univention/admin/syntax.py	
+++ management/univention-directory-manager-modules/modules/univention/admin/syntax.py	
@@ -1331,6 +1331,44 @@ class UNIX_TimeInterval( complex ):
 	subsyntaxes = ( ( '', integer ), ( '', TimeUnits ) )
 	size = ( 'Half', 'Half' )
 
+	@classmethod
+	def parse(cls, texts):
+		return super(UNIX_TimeInterval, cls).parse(texts)
+
+class UNIX_BoundedTimeInterval( UNIX_TimeInterval ):
+	lower_bound = -1 # in seconds, -1 unbounded
+	upper_bound = -1 # in seconds, -1 unbounded
+	error_message = _ ("Value out of bounds (%d - %d seconds)")
+
+	@classmethod
+	def parse(cls, texts):
+		parsed = super(UNIX_BoundedTimeInterval, cls).parse(texts)
+
+		in_seconds = int(parsed[0])
+		if len(parsed) > 1:
+			in_seconds = {
+				'seconds': lambda x: x,
+				'minutes': lambda x: x * 60,
+				'hours': lambda x: x * 60 * 60,
+				'days': lambda x: x * 24 * 60 * 60,
+			}[parsed[1]](in_seconds)
+
+		msg = cls.error_message % (cls.lower_bound, cls.upper_bound)
+		if cls.lower_bound != -1 and in_seconds < cls.lower_bound:
+			raise univention.admin.uexceptions.valueError(msg)
+		if cls.upper_bound != -1 and in_seconds > cls.upper_bound:
+			raise univention.admin.uexceptions.valueError(msg)
+
+		return parsed
+
+class SambaMinPwdAge( UNIX_BoundedTimeInterval ):
+	lower_bound = 0
+	upper_bound = 998 * 24 * 60 * 60 # 998 days in seconds
+
+class SambaMaxPwdAge( UNIX_BoundedTimeInterval ):
+	lower_bound = 0
+	upper_bound = 999 * 24 * 60 * 60 # 999 days in seconds
+
 class NetworkType( select ):
 	choices = ( ( 'ethernet', _( 'Ethernet' ) ), ( 'fddi', _( 'FDDI' ) ), ( 'token-ring', _( 'Token-Ring' ) ) )