- The GDID is a unique and persistent code that identifies each Windows installation, regardless of whether it is a physical or virtual machine.
- This identifier allows linking user activity across different connections, including the use of VPNs or proxies.
- Microsoft has confirmed that the GDID cannot be disabled without compromising system activation and Microsoft Store functionality.
You're probably used to Windows asking for permission for a thousand things, but there are pieces on the board that move in complete secrecy . Recently, an element called GDID has come to light—a code that Microsoft has admitted exists but which doesn't have an off switch, making users quite nervous.
We're not talking about your typical browser cookie or an IP address that changes every other day. GDID is something much deeper, a kind of digital license plate that's attached to your operating system installation and can reveal much more about you than you might imagine, especially if you like to browse the web anonymously.
What exactly is GDID and how does it work?
The Global Device Identifier (GDID) is essentially a unique code assigned to each installed copy of Windows. According to Microsoft, its purpose is to distinguish one installation from another in order to manage internal services, licenses, and data synchronization. Interestingly, this code applies to both physical computers and virtual machines.
To put it simply, the creation process is a complex interplay of services. It all begins with the wlidsvc service , which contacts the login.live.com servers to request a PUID (a passport ID). Once received, this value is stored in the system registry, specifically in an identity path, and then the Connected Devices Platform registers it in the Microsoft Device Directory.
The format of this code is quite simple: a lowercase 'g' followed by a decimal number. Furthermore, the Delivery Optimization service uses this same data when your PC shares or downloads updates, meaning the GDID travels through various internal channels of the operating system.
The case that changed everything: the hunt for a hacker
This identifier wasn't an open secret before, but it was made public thanks to a federal complaint in the United States. The protagonist was Peter Stokes, a young man linked to the hacker group Scattered Spider . Stokes believed he was protected by using VPNs and proxies to cover his tracks while attacking a luxury jewelry store, but the GDID betrayed him.
The FBI discovered that, although the IP address changed constantly, the same GDID appeared in Microsoft logs every time the suspect accessed certain services, such as ngrok. This allowed investigators to connect seemingly unrelated dots, linking the creation of malicious accounts to real-time activity on the physical device.
The most striking finding is that the GDID allowed investigators to trace Stokes' activity across several countries , including Estonia, Thailand, and the United States. By cross-referencing this persistent identifier with logins from social media platforms like Snapchat and Facebook, as well as hotel records, the forensic team was able to piece together a perfect puzzle of his movements.
The debate on privacy and user control
This is where things get ugly. Many security experts have labeled Windows as surveillance software because GDID lacks a consent screen. There's no "Accept" or "Reject" button during system installation; it simply happens in the background without the user's knowledge.
Furthermore, Microsoft has made it clear that this cannot be disabled . Attempting to delete or block it at a deep level would likely break Windows activation and leave you without access to Microsoft Store apps. This dependency creates a dilemma: either you accept being marked with a persistent code by the system, or you lose basic software functionality.
A very important point is that even if you reinstall Windows from scratch, a new GDID will be generated . However, if you sign in again with the same Microsoft account, the company can link that new code to your previous history, making complete erasure virtually impossible for the average user.
Tips to mitigate tracking in Windows
If you're not thrilled about your PC having such a persistent digital footprint, there are a few things you can do to reduce telemetry , even if you can't completely erase the GDID. The most effective option is to use a local account instead of a Microsoft account, as this weakens the direct link between your real identity and the device code.
It's also advisable to go into your Privacy and Security settings to disable optional diagnostic data and personalized ads. Another helpful measure is to restrict cloud content searches to prevent your local queries from ending up on Bing's servers.
For those working in high-risk environments, such as investigative journalism or activism, the experts' recommendation is drastic: stop using Windows and switch to Linux distributions combined with Tor. At the end of the day, a VPN is a patch for your IP address, but it's useless if the operating system itself is sending a unique identifier to the central server.