Find OS X AD user UniqueID collisions

collision.py

#!/usr/bin/python
# -*- coding: utf-8 -*-


import sys
import base64

userids = dict()

with open(sys.argv[1]) as f:
    for line in f:
        if line.startswith("dn:"):
            username = line.partition("=")[2].partition(",")[0]
        elif line.startswith("objectGUID:"):
            guidb64 = line.rstrip().partition(" ")[2]
            guidbin = base64.b64decode(guidb64)
            guidbe = guidbin[3] + guidbin[2] + guidbin[1] + guidbin[0]
            uniqueid = int(guidbe.encode("hex"), 16) & 0x7fffffff
            if uniqueid in userids:
                print "Collision: %d = %s, %s" % (uniqueid, username, userids[uniqueid])
            userids[uniqueid] = username

getaccounts.sh

#!/bin/bash

# This limits results to usernames starting with x for testing, adjust as appropriate: (&(objectClass=user)(cn=x*))
ldapsearch -LLL -H ldap://dc01.domain.example -b 'OU=Users,DC=domain,DC=example' -E pr=1000/noprompt "(&(objectClass=user)(cn=x*))" objectGUID > accounts.txt