Bug was introduced with c2cac449c89d34f50da98c6eb59442bf63b67477 to optimize the GUID handling code. NS GUID are in a slightly different format (3 hyphens, not 4) and the corresponding function to format NS GUID is notably out of sync with the parse. This code should probably just be removed altogether with the removal of the AD OpenLDAP backend.