--- modules/univention/s4connector/s4/__init__.py	(Revision 77482)
+++ modules/univention/s4connector/s4/__init__.py	(Arbeitskopie)
@@ -926,7 +926,7 @@ 
 				if s4_group_attrs:
 					s4_members = self.get_s4_members(s4_group_dn, s4_group_attrs)
 					group_cache = self.group_members_cache_con[s4_group_dn.lower()]
-					group_cache.extend(m.lower() for m in s4_members)
+					group_cache.extend([m.lower() for m in s4_members])
 
 			ud.debug(ud.LDAP, ud.INFO, "__init__: self.group_members_cache_con: %s" % self.group_members_cache_con)
 
@@ -1502,11 +1502,13 @@ 
 			return True  # nothing left to do
 		else:
 			s4_members = self.get_s4_members(s4_group_object['dn'], ldap_object_s4_group)
-			s4_members = map(compatible_modstring, s4_members)
 			object_dn_modstring = compatible_modstring(object['dn'])
+			object_dn_modstring_lower = object_dn_modstring.lower()
 
-			s4_members_lower = map(str.lower, s4_members)
-			if object_dn_modstring.lower() not in s4_members_lower:  # add as member
+			for member in s4_members:
+				if object_dn_modstring_lower == compatible_modstring(member).lower():
+					break
+			else:
 				s4_members.append(object_dn_modstring)
 				ud.debug(ud.LDAP, ud.INFO, "primary_group_sync_from_ucs: primary Group needs change of membership in S4")
 				self.lo_s4.lo.modify_s(compatible_modstring(s4_group_object['dn']), [(ldap.MOD_REPLACE, 'member', s4_members)])