diff --git a/management/univention-directory-manager-modules/modules/univention/admin/handlers/users/user.py b/management/univention-directory-manager-modules/modules/univention/admin/handlers/users/user.py
index 546fdd5c3a..f3528480eb 100644
--- a/management/univention-directory-manager-modules/modules/univention/admin/handlers/users/user.py
+++ b/management/univention-directory-manager-modules/modules/univention/admin/handlers/users/user.py
@@ -1276,7 +1276,8 @@ def unmapKrb5ValidEndToUserexpiry(oldattr):
 	if 'krb5ValidEnd' in oldattr:
 		krb5validend = oldattr['krb5ValidEnd'][0]
 		univention.debug.debug(univention.debug.ADMIN, univention.debug.INFO, 'krb5validend is: %s' % krb5validend)
-		return "%s-%s-%s" % (krb5validend[0:4], krb5validend[4:6], krb5validend[6:8])
+		userexpiry_epoch = calendar.timegm(time.strptime(krb5validend, '%Y%m%d%H%M%SZ'))
+		return time.strftime("%Y-%m-%d", time.gmtime(userexpiry_epoch))
 
 
 def unmapSambaKickoffTimeToUserexpiry(oldattr):
@@ -2182,7 +2183,7 @@ class object(univention.admin.handlers.simpleLdap):
 		if self.hasChanged('userexpiry'):
 			sambaKickoffTime = ''
 			if self['userexpiry']:
-				sambaKickoffTime = "%d" % long(time.mktime(time.strptime(self['userexpiry'], "%Y-%m-%d")))
+				sambaKickoffTime = "%d" % long(calendar.timegm(time.strptime(self['userexpiry'], "%Y-%m-%d")))
 				univention.debug.debug(univention.debug.ADMIN, univention.debug.INFO, 'sambaKickoffTime: %s' % sambaKickoffTime)
 			old_sambaKickoffTime = self.oldattr.get('sambaKickoffTime', '')
 			if old_sambaKickoffTime != sambaKickoffTime:
@@ -2193,7 +2194,8 @@ class object(univention.admin.handlers.simpleLdap):
 		if self.hasChanged('userexpiry'):
 			krb5ValidEnd = ''
 			if self['userexpiry']:
-				krb5ValidEnd = "%s%s%s000000Z" % (self['userexpiry'][0:4], self['userexpiry'][5:7], self['userexpiry'][8:10])
+				userexpiry_epoch = calendar.timegm(time.strptime(self['userexpiry'], "%Y-%m-%d"))
+				krb5ValidEnd = time.strftime("%Y%m%d000000Z", time.gmtime(userexpiry_epoch))
 				univention.debug.debug(univention.debug.ADMIN, univention.debug.INFO, 'krb5ValidEnd: %s' % krb5ValidEnd)
 			old_krb5ValidEnd = self.oldattr.get('krb5ValidEnd', '')
 			if old_krb5ValidEnd != krb5ValidEnd:
@@ -2208,7 +2210,7 @@ class object(univention.admin.handlers.simpleLdap):
 			if self['disabled'] == '1' and self.hasChanged('disabled') and not self.hasChanged('userexpiry'):
 				shadowExpire = '1'
 			elif self['userexpiry']:
-				shadowExpire = "%d" % long(time.mktime(time.strptime(self['userexpiry'], "%Y-%m-%d")) / 3600 / 24 + 1)
+				shadowExpire = "%d" % long(calendar.timegm(time.strptime(self['userexpiry'], "%Y-%m-%d")) / 3600 / 24 + 1)
 			elif self['disabled'] == '1':
 				shadowExpire = '1'
 			else: