diff --git a/include/ImageTemplate.h b/include/ImageTemplate.h
index a7f27a6275..6cfec47f74 100644
--- a/include/ImageTemplate.h
+++ b/include/ImageTemplate.h
@@ -108,6 +108,11 @@ private:
     static string saving_attribute;
     static string saving_hot_attribute;
 
+    bool has_restricted()
+    {
+        return restricted_attributes.size() > 0;
+    };
+
     /**
      * Stores the attributes as restricted, these attributes will be used in
      * ImageTemplate::check
diff --git a/include/Template.h b/include/Template.h
index 83f1045957..de029752a9 100644
--- a/include/Template.h
+++ b/include/Template.h
@@ -390,6 +390,11 @@ public:
       */
      virtual void remove_all_except_restricted();
 
+     /**
+      *  @return true if the template defines one or more restricted attributes
+      */
+     virtual bool has_restricted();
+
 protected:
     /**
      *  The template attributes
diff --git a/include/VirtualMachineTemplate.h b/include/VirtualMachineTemplate.h
index f61aad7c49..2bab284e62 100644
--- a/include/VirtualMachineTemplate.h
+++ b/include/VirtualMachineTemplate.h
@@ -91,6 +91,11 @@ private:
 
     static vector<string> restricted_attributes;
 
+    bool has_restricted()
+    {
+        return restricted_attributes.size() > 0;
+    };
+
     /**
      * Stores the attributes as restricted, these attributes will be used in
      * VirtualMachineTemplate::check
diff --git a/include/VirtualNetworkTemplate.h b/include/VirtualNetworkTemplate.h
index 44c0017168..193716290d 100644
--- a/include/VirtualNetworkTemplate.h
+++ b/include/VirtualNetworkTemplate.h
@@ -64,6 +64,11 @@ private:
 
     static vector<string> restricted_attributes;
 
+    bool has_restricted()
+    {
+        return restricted_attributes.size() > 0;
+    };
+
     /**
      * Stores the attributes as restricted, these attributes will be used in
      * VirtualMachineTemplate::check
diff --git a/src/pool/PoolObjectSQL.cc b/src/pool/PoolObjectSQL.cc
index 1e34ffb8f7..453f9062f2 100644
--- a/src/pool/PoolObjectSQL.cc
+++ b/src/pool/PoolObjectSQL.cc
@@ -184,7 +184,7 @@ int PoolObjectSQL::replace_template(
         return -1;
     }
 
-    if (keep_restricted)
+    if (keep_restricted && new_tmpl->has_restricted())
     {
         new_tmpl->remove_restricted();
 
diff --git a/src/template/Template.cc b/src/template/Template.cc
index 5b7d820e6c..e87c1f7a63 100644
--- a/src/template/Template.cc
+++ b/src/template/Template.cc
@@ -236,7 +236,7 @@ void Template::set(Attribute * attr)
 /* -------------------------------------------------------------------------- */
 
 int Template::replace(const string& name, const string& value)
-{     
+{
     pair<multimap<string, Attribute *>::iterator,
          multimap<string, Attribute *>::iterator>   index;
 
@@ -255,7 +255,7 @@ int Template::replace(const string& name, const string& value)
         attributes.erase(index.first, index.second);
     }
 
-    SingleAttribute * sattr = new SingleAttribute(name,value);    
+    SingleAttribute * sattr = new SingleAttribute(name,value);
 
     attributes.insert(make_pair(sattr->name(), sattr));
 
@@ -872,6 +872,14 @@ void Template::remove_all_except_restricted()
 /* -------------------------------------------------------------------------- */
 /* -------------------------------------------------------------------------- */
 
+bool Template::has_restricted()
+{
+    return false;
+}
+
+/* -------------------------------------------------------------------------- */
+/* -------------------------------------------------------------------------- */
+
 void Template::remove_restricted(const vector<string> &restricted_attributes)
 {
     size_t pos;
diff --git a/src/vnm/AddressRange.cc b/src/vnm/AddressRange.cc
index 65864e01f0..33e87ec097 100644
--- a/src/vnm/AddressRange.cc
+++ b/src/vnm/AddressRange.cc
@@ -210,7 +210,7 @@ int AddressRange::update_attributes(
     int pid;
     bool is_reservation = (get_attribute("PARENT_NETWORK_AR_ID", pid) == 0);
 
-    if (keep_restricted)
+    if (keep_restricted && restricted_set)
     {
         remove_restricted(vup);
     }
@@ -248,7 +248,7 @@ int AddressRange::update_attributes(
 
     /* ----------------- restricted attributes ----------------- */
 
-    if (keep_restricted)
+    if (keep_restricted && restricted_set)
     {
         remove_all_except_restricted(attr);