--- a/services/univention-samba4/conffiles/etc/samba/smb.conf.d/10global	
+++ a/services/univention-samba4/conffiles/etc/samba/smb.conf.d/10global	
@@ -125,7 +125,7 @@ if configRegistry.get('samba/register/exclude/interfaces') and not configRegistr
 		print '\tbind interfaces only = yes'
 		print '\tinterfaces = lo %s' % ' '.join(interface_list)
 
-if not configRegistry.is_true('samba4/kccsrv/samba_kcc', False):
+if not configRegistry.is_true('samba4/kccsrv/samba_kcc', True):
 	print '\tkccsrv:samba_kcc = False'
 @!@
 ; ---------------------</10global>------------------------
--- a/services/univention-samba4/debian/univention-samba4.postinst	
+++ a/services/univention-samba4/debian/univention-samba4.postinst	
@@ -415,6 +415,11 @@ secret: $machine_secret
 					/etc/init.d/bind9 restart
 				fi
 		fi
+
+		### The following block of code may be removed after ucs_4.3-2
+		if dpkg --compare-versions "$2" lt-nl "7.0.3-1"; then
+			univention-config-registry set samba4/kccsrv/samba_kcc?False
+		fi
 	fi
 
 	ntp_socket_dir='/var/lib/samba/ntp_signd'