diff --git a/services/univention-s4-connector/modules/univention/s4connector/s4/password.py b/services/univention-s4-connector/modules/univention/s4connector/s4/password.py
index bcddf3a..b00ebe6 100644
--- a/services/univention-s4-connector/modules/univention/s4connector/s4/password.py
+++ b/services/univention-s4-connector/modules/univention/s4connector/s4/password.py
@@ -585,11 +585,8 @@ def password_sync_ucs_to_s4(s4connector, key, object):
 		# Usecase: LDB module on ucs_3.0-0-ucsschool slaves creates XP computers/windows in UDM without password
 		if ucsNThash or sambaPwdLastSet:
 			pwd_set = True
-			if unicodePwd_attr:
-				modlist.append((ldap.MOD_DELETE, 'unicodePwd', unicodePwd_attr))
-			if ucsNThash:
-				unicodePwd_new = binascii.a2b_hex(ucsNThash)
-				modlist.append((ldap.MOD_ADD, 'unicodePwd', unicodePwd_new))
+			unicodePwd_new = binascii.a2b_hex(ucsNThash)
+			modlist.append((ldap.MOD_REPLACE, 'unicodePwd', unicodePwd_new))
 
 	if not ucsLMhash == s4LMhash:
 		ud.debug(ud.LDAP, ud.INFO, "password_sync_ucs_to_s4: LM Hash S4: %s LM Hash UCS: %s" % (s4LMhash, ucsLMhash))
@@ -603,12 +600,10 @@ def password_sync_ucs_to_s4(s4connector, key, object):
 	if pwd_set or not supplementalCredentials:
 		if krb5Principal:
 			# encoding of Samba4 supplementalCredentials
-			if supplementalCredentials:
-				modlist.append((ldap.MOD_DELETE, 'supplementalCredentials', supplementalCredentials))
 			if krb5Key:
 				supplementalCredentials_new = calculate_supplementalCredentials(krb5Key, supplementalCredentials)
 				if supplementalCredentials_new:
-					modlist.append((ldap.MOD_ADD, 'supplementalCredentials', supplementalCredentials_new))
+					modlist.append((ldap.MOD_REPLACE, 'supplementalCredentials', supplementalCredentials_new))
 				else:
 					ud.debug(ud.LDAP, ud.INFO, "password_sync_ucs_to_s4: no supplementalCredentials_new")
 				# if supplementalCredentials:
diff --git a/test/ucs-ec2-tools b/test/ucs-ec2-tools
index 755b752..956abb4 160000
--- a/test/ucs-ec2-tools
+++ b/test/ucs-ec2-tools
@@ -1 +1 @@
-Subproject commit 755b752d461b62ba29666294762e04f00ea9a74f
+Subproject commit 956abb4d0e3a0d8af80b1e8b32e7191c2e946541