diff --git a/services/univention-s4-connector/modules/univention/s4connector/s4/__init__.py b/services/univention-s4-connector/modules/univention/s4connector/s4/__init__.py
index 6d5fb6c4d2..0194614d25 100644
--- a/services/univention-s4-connector/modules/univention/s4connector/s4/__init__.py
+++ b/services/univention-s4-connector/modules/univention/s4connector/s4/__init__.py
@@ -355,7 +355,8 @@ def samaccountname_dn_mapping(s4connector, given_object, dn_mapping_stored, ucso
 						s4_rdn = ldap.dn.str2dn(result[0][0])[0]
 						new_s4_dn = unicode(ldap.dn.dn2str([s4_rdn] + exploded_dn[1:]), 'utf8')
 						pos = new_s4_dn.lower().rfind(s4connector.lo_s4.base.lower())
-						newdn = new_s4_dn[:pos] + s4connector.lo.base
+						if pos != -1:
+							newdn = new_s4_dn[:pos] + s4connector.lo.base
 				else:
 					newdn_rdn = [('cn', fst_rdn_value_utf8, ldap.AVA_STRING)]
 					newdn = unicode(ldap.dn.dn2str([newdn_rdn] + exploded_dn[1:]), 'utf8')  # new object, don't need to change