diff --git a/lam/lib/modules/posixAccount.inc b/lam/lib/modules/posixAccount.inc
index d6d84ce7..5f333e4c 100644
--- a/lam/lib/modules/posixAccount.inc
+++ b/lam/lib/modules/posixAccount.inc
@@ -2377,6 +2377,17 @@ class posixAccount extends baseModule implements passwordService {
 		return null;
 	}
 	
+	/**
+	 * Returns if this account can be locked.
+	 * This is the case if a hashed password is set ("{" at the beginning).
+	 */
+	public function isLockable() {
+		if (isset($this->attributes['userPassword'][0]) && ((substr($this->attributes['userPassword'][0], 0, 1) == "{") || (substr($this->attributes['userPassword'][0], 1, 1) == "{"))) {
+			return true;
+		}
+		return false;
+	}
+	
 	/**
 	 * Returns if the Unix part of the current account is locked.
 	 * 
@@ -2390,14 +2401,18 @@ class posixAccount extends baseModule implements passwordService {
 	 * Locks the user password of this account.
 	 */
 	public function lock() {
-		$this->attributes['userPassword'][0] = pwd_disable($this->attributes['userPassword'][0]);
+		if (isset($this->attributes['userPassword'][0])) {
+			$this->attributes['userPassword'][0] = pwd_disable($this->attributes['userPassword'][0]);
+		}
 	}
 	
 	/**
 	 * Unlocks the user password of this account.
 	 */
 	public function unlock() {
-		$this->attributes['userPassword'][0] = pwd_enable($this->attributes['userPassword'][0]);
+		if (isset($this->attributes['userPassword'][0])) {
+			$this->attributes['userPassword'][0] = pwd_enable($this->attributes['userPassword'][0]);
+		}
 	}
 	
 	/**
diff --git a/lam/lib/modules/sambaSamAccount.inc b/lam/lib/modules/sambaSamAccount.inc
index 8148c067..225dd129 100644
--- a/lam/lib/modules/sambaSamAccount.inc
+++ b/lam/lib/modules/sambaSamAccount.inc
@@ -2350,6 +2350,11 @@ class sambaSamAccount extends baseModule implements passwordService {
 	 */
 	public function deactivate() {
 		$this->deactivated = true;
+		$flags = $this->attributes['sambaAcctFlags'][0];
+		if (strpos($flags, 'D') === false) {
+			$flags[strpos($flags, ' ')] = 'D';
+		}
+		$this->attributes['sambaAcctFlags'][0] = $flags;
 	}
 	
 	/**
@@ -2357,6 +2362,8 @@ class sambaSamAccount extends baseModule implements passwordService {
 	 */
 	public function activate() {
 		$this->deactivated = false;
+		$this->attributes['sambaAcctFlags'][0] = str_replace('D', '', $this->attributes['sambaAcctFlags'][0]);
+		$this->attributes['sambaAcctFlags'][0] = str_replace(']', ' ]', $this->attributes['sambaAcctFlags'][0]);
 	}
 	
 }
diff --git a/lam/lib/types/user.inc b/lam/lib/types/user.inc
index 842d9e8b..60e12027 100644
--- a/lam/lib/types/user.inc
+++ b/lam/lib/types/user.inc
@@ -203,7 +203,7 @@ class user extends baseType {
 	 */
 	private function buildAccountStatusIcon($container) {
 		// check if there are account parts that can be locked
-		$unixAvailable = ($container->getAccountModule('posixAccount') != null);
+		$unixAvailable = ($container->getAccountModule('posixAccount') != null) && $container->getAccountModule('posixAccount')->isLockable();
 		$sambaAvailable = (($container->getAccountModule('sambaSamAccount') != null) && $container->getAccountModule('sambaSamAccount')->isExtensionEnabled());
 		$ppolicyAvailable = ($container->getAccountModule('ppolicyUser') != null);
 		if (!$unixAvailable && !$sambaAvailable && !$ppolicyAvailable) {