def _ProcessHost(self, d):
    dn = d['distinguishedName'][0]
    # Parse the hostname out of the distinguishedName, which is in this format:
    #   CN=<timestamp>{<recovery_guid>},CN=<hostname>,OU=Workstations,...
    hostname = dn.split(',')[1][len('CN='):]

    # Ignore records with legacy DNs, as they have invalid RecoveryGUIDs,
    # and all have separate valid records.
    if INVALID_DN_REGEX.search(dn):
      raise InvalidDistinguishedName(dn)

    # Some msFVE-RecoveryGuid values may be invalid, so carefully attempt to
    # contruct the recovery_guid, and skip over objects which are invalid.
    try:
      recovery_guid = str(
          uuid.UUID(bytes_le=d['msFVE-RecoveryGuid'][0])).upper()
    except ValueError:
      raise InvalidRecoveryGuid(
          '%s: %s' % (hostname, d['msFVE-RecoveryGuid']))

    if FLAGS.redact_recovery_passwords:
      recovery_password = '--redacted--'
    else:
      recovery_password = d['msFVE-RecoveryPassword'][0]

    when_created = d['whenCreated'][0]
    try:
      datetime.datetime.strptime(when_created, '%Y%m%d%H%M%S.0Z')
    except ValueError:
      logging.error('Unknown whenCreated format: %r', when_created)
      when_created = ''

    parent_guid = None
    # msFVE-RecoveryObject distinguishedName is in the form of:
    #   CN=<TIMESTAMP>{<UUID>},CN=<HOSTNAME>,DC=example,DC=com
    # where CN=<HOSTNAME>,.* is the parent's distinguishedName.
    # Given that the the msFVE-RecoveryObject is a child of the parent host,
    # split off the child to obtain the parent's DN.
    parent_dn = dn.split(',', 1)[1]
    # Alternatively:  parent_dn = dn.replace('CN=%s,' % d['name'][0], '')
    ldap_filter = '(&(objectCategory=computer))'
    for host in self._QueryLdap(parent_dn, ldap_filter, scope=ldap.SCOPE_BASE):
      parent_guid = str(uuid.UUID(bytes_le=host['objectGUID'][0])).upper()
      # TODO(user): consider other parent data; os/os_version/sid?

    metadata = {
        'hostname': hostname,
        'dn': dn,
        'when_created': when_created,
        'parent_guid': parent_guid,
    }

    self.client.UploadPassphrase(recovery_guid, recovery_password, metadata)
    logging.info('Escrowed recovery password: %r', recovery_guid)
Retrieves recovery data from an LDAP host and escrows to CauliflowerVest.
dataset/ETHPy150Open google/cauliflowervest/src/cauliflowervest/client/win/bitlocker_ad_sync.py/BitLockerAdSync._ProcessHost