diff --git a/management/univention-directory-manager-modules/modules/univention/admin/handlers/users/user.py b/management/univention-directory-manager-modules/modules/univention/admin/handlers/users/user.py
index 546fdd5c3a..053ddf220d 100644
--- a/management/univention-directory-manager-modules/modules/univention/admin/handlers/users/user.py
+++ b/management/univention-directory-manager-modules/modules/univention/admin/handlers/users/user.py
@@ -1094,8 +1094,8 @@ def posixSecondsToLocaltimeDate(seconds):
 	return time.strftime("%Y-%m-%d %H:%M:%S", time.localtime(seconds))
 
 
-def posixDaysToDate(days):
-	return time.strftime("%Y-%m-%d", time.gmtime(long(days) * 3600 * 24))
+def posixDaysToLocalDate(days):
+	return time.strftime("%Y-%m-%d", time.localtime(long(days) * 3600 * 24))
 
 
 def sambaWorkstationsMap(workstations):
@@ -1267,22 +1267,23 @@ def unmapShadowExpireToUserexpiry(oldattr):
 	# shadowExpire contains the absolute date to expire the account.
 
 	if 'shadowExpire' in oldattr and len(oldattr['shadowExpire']) > 0:
-		univention.debug.debug(univention.debug.ADMIN, univention.debug.INFO, 'userexpiry: %s' % posixDaysToDate(oldattr['shadowExpire'][0]))
+		univention.debug.debug(univention.debug.ADMIN, univention.debug.INFO, 'userexpiry: %s' % posixDaysToLocalDate(oldattr['shadowExpire'][0]))
 		if oldattr['shadowExpire'][0] != '1':
-			return posixDaysToDate(oldattr['shadowExpire'][0])
+			return posixDaysToLocalDate(oldattr['shadowExpire'][0])
 
 
 def unmapKrb5ValidEndToUserexpiry(oldattr):
 	if 'krb5ValidEnd' in oldattr:
 		krb5validend = oldattr['krb5ValidEnd'][0]
 		univention.debug.debug(univention.debug.ADMIN, univention.debug.INFO, 'krb5validend is: %s' % krb5validend)
-		return "%s-%s-%s" % (krb5validend[0:4], krb5validend[4:6], krb5validend[6:8])
+		userexpiry_epoch = calendar.timegm(time.strptime(krb5validend, '%Y%m%d%H%M%SZ'))
+		return time.strftime("%Y-%m-%d", time.localtime(userexpiry_epoch))
 
 
 def unmapSambaKickoffTimeToUserexpiry(oldattr):
 	if 'sambaKickoffTime' in oldattr:
 		univention.debug.debug(univention.debug.ADMIN, univention.debug.INFO, 'sambaKickoffTime is: %s' % oldattr['sambaKickoffTime'][0])
-		return time.strftime("%Y-%m-%d", time.gmtime(long(oldattr['sambaKickoffTime'][0]) + (3600 * 24)))
+		return time.strftime("%Y-%m-%d", time.localtime(long(oldattr['sambaKickoffTime'][0]) + (3600 * 24)))
 
 
 def unmapPasswordExpiry(oldattr):
@@ -1293,7 +1294,7 @@ def unmapPasswordExpiry(oldattr):
 			shadow_last_change = int(oldattr['shadowLastChange'][0])
 		except ValueError:
 			univention.debug.debug(univention.debug.ADMIN, univention.debug.WARN, 'users/user: failed to calculate password expiration correctly, use only shadowMax instead')
-		return posixDaysToDate(shadow_last_change + shadow_max)
+		return posixDaysToLocalDate(shadow_last_change + shadow_max)
 
 
 def unmapDisabled(oldattr):
@@ -2193,7 +2194,8 @@ class object(univention.admin.handlers.simpleLdap):
 		if self.hasChanged('userexpiry'):
 			krb5ValidEnd = ''
 			if self['userexpiry']:
-				krb5ValidEnd = "%s%s%s000000Z" % (self['userexpiry'][0:4], self['userexpiry'][5:7], self['userexpiry'][8:10])
+				userexpiry_epoch = time.mktime(time.strptime(self['userexpiry'], "%Y-%m-%d"))
+				krb5ValidEnd = time.strftime("%Y%m%d000000Z", time.gmtime(userexpiry_epoch))
 				univention.debug.debug(univention.debug.ADMIN, univention.debug.INFO, 'krb5ValidEnd: %s' % krb5ValidEnd)
 			old_krb5ValidEnd = self.oldattr.get('krb5ValidEnd', '')
 			if old_krb5ValidEnd != krb5ValidEnd: