I'm in the process of determining this myself, if it is in fact possible, but for now, it appears there's a methodology for encoding/decoding SIDs:
- https://en.wikipedia.org/wiki/Security_Identifier#Decoding_Machine_SID
- https://msdn.microsoft.com/en-us/library/windows/desktop/aa379649(v=vs.85).aspx
Some C# code:
byte[] sidInBinaryForm = ...; var sid = new SecurityIdentifier(sidInBinaryForm, 0); string accountName = sid.Translate(typeof (NTAccount)).Value;
I'm almost 100% sure that this is strictly a decoding routine and not some wrapper on top of a LDAP call, but something to play with nevertheless.
Also see: