Where should VST2 plugins be located?

Actually, the GUID is not needed anymore, you can put in any number you like.

In our initial design a comparison of both, name and GUID was done, but we drove into some conceptual problems with that. So now the GUID check is omitted, though still some arbitrary entry in the whitelist is necessary.
But important is still the correct name. The name must match the VSTi’s bundle/dll name without the extension.