diff --git a/services/univention-s4-connector/modules/univention/s4connector/s4/__init__.py b/services/univention-s4-connector/modules/univention/s4connector/s4/__init__.py
index 6a6b510571..7206db31cf 100644
--- a/services/univention-s4-connector/modules/univention/s4connector/s4/__init__.py
+++ b/services/univention-s4-connector/modules/univention/s4connector/s4/__init__.py
@@ -299,7 +299,7 @@ def samaccountname_dn_mapping(s4connector, given_object, dn_mapping_stored, ucso
 				return False
 
 	for dn_key in ['dn', 'olddn']:
-		ud.debug(ud.LDAP, ud.INFO, "samaccount_dn_mapping: check newdn for key %s:" % dn_key)
+		ud.debug(ud.LDAP, ud.INFO, "samaccount_dn_mapping: check newdn for key %s: %s" % (dn_key, object.get(dn_key)))
 		if dn_key in object and not dn_premapped(object, dn_key, dn_mapping_stored):
 
 			dn = object[dn_key]
@@ -354,7 +354,8 @@ def samaccountname_dn_mapping(s4connector, given_object, dn_mapping_stored, ucso
 					else:
 						s4_rdn = ldap.dn.str2dn(result[0][0])[0]
 						new_s4_dn = unicode(ldap.dn.dn2str([s4_rdn] + exploded_dn[1:]), 'utf8')
-						newdn = new_s4_dn.lower().replace(s4connector.lo_s4.base.lower(), s4connector.lo.base.lower())
+						pos = new_s4_dn.lower().rfind(s4connector.lo_s4.base.lower())
+						newdn = new_s4_dn[:pos] + s4connector.lo.base
 
 				else:
 					newdn_rdn = [('cn', fst_rdn_value_utf8, ldap.AVA_STRING)]