diff --git a/base/univention-system-activation/debian/univention-system-activation.postrm b/base/univention-system-activation/debian/univention-system-activation.postrm
index 3691f78..ca76b72 100644
--- a/base/univention-system-activation/debian/univention-system-activation.postrm
+++ b/base/univention-system-activation/debian/univention-system-activation.postrm
@@ -32,15 +32,4 @@
 
 #DEBHELPER#
 
-# allow root login again
-ucr unset --force auth/gdm/user/root \
-				auth/kdm/user/root \
-				auth/login/user/root \
-				auth/other/user/root \
-				auth/sshd/user/root
-
-# reset su restrictions
-ucr unset --force auth/su/restrict \
-				auth/su/user/root
-
 exit 0
diff --git a/base/univention-system-activation/debian/univention-system-activation.prerm b/base/univention-system-activation/debian/univention-system-activation.prerm
index ccfe5b6..c40fac2 100644
--- a/base/univention-system-activation/debian/univention-system-activation.prerm
+++ b/base/univention-system-activation/debian/univention-system-activation.prerm
@@ -37,6 +37,8 @@ case "$1" in
 		# if package configuration is active, deactivate it
 		if [ -n "$apache2_system_activation_sites" ]; then
 			/usr/sbin/univention-system-activation stop
+		else
+			/usr/sbin/univention-system-activation allow-root
 		fi
 		;;
 
diff --git a/base/univention-system-activation/scripts/univention-system-activation b/base/univention-system-activation/scripts/univention-system-activation
index 6b7e705..9fcf82e 100755
--- a/base/univention-system-activation/scripts/univention-system-activation
+++ b/base/univention-system-activation/scripts/univention-system-activation
@@ -50,8 +50,11 @@ function allow_root_login() {
 		auth/su/user/root
 
 	# some values were not set during the pam installation, because they were set
-	# in the force layer. Reconfigure pam
-	dpkg -l univention-pam > /dev/null 2>&1 && dpkg-reconfigure univention-pam
+	# in the force layer. Reconfigure PAM if no other dpkg process is running
+	# (e.g., when "stop" is called in the postrm script).
+	fuser /var/lib/dpkg/lock >/dev/null 2>&1 \
+		|| dpkg -l univention-pam > /dev/null 2>&1 \
+		&& dpkg-reconfigure univention-pam
 }
 
 function restrict_root_login() {