--- a/ipaplatform/debian/tasks.py
+++ b/ipaplatform/debian/tasks.py
@@ -9,14 +9,20 @@ This module contains default Debian-spec
 from ipaplatform.base.tasks import BaseTaskNamespace
 from ipaplatform.redhat.tasks import RedHatTaskNamespace
 
+from ipapython import ipautil
 
 class DebianTaskNamespace(RedHatTaskNamespace):
     @staticmethod
     def restore_pre_ipa_client_configuration(fstore, statestore,
                                              was_sssd_installed,
                                              was_sssd_configured):
-        # Debian doesn't use authconfig, nothing to restore
-        return True
+        ret = True
+        try:
+            ipautil.run(["pam-auth-update",
+                         "--package", "--remove", "mkhomedir"])
+        except ipautil.CalledProcessError:
+            ret = False
+        return ret
 
     @staticmethod
     def set_nisdomain(nisdomain):
@@ -25,8 +31,13 @@ class DebianTaskNamespace(RedHatTaskName
 
     @staticmethod
     def modify_nsswitch_pam_stack(sssd, mkhomedir, statestore):
-        # Debian doesn't use authconfig, this is handled by pam-auth-update
-        return True
+        if mkhomedir:
+            try:
+                ipautil.run(["pam-auth-update", "--package", "--enable", "mkhomedir"])
+            except ipautil.CalledProcessError:
+                return False
+        else:
+            return True
 
     @staticmethod
     def modify_pam_to_use_krb5(statestore):
