- The GDID is a unique and persistent identifier assigned to each Windows installation that allows the device to be tracked regardless of the IP address.
- It was key for the FBI to identify a cybercriminal by linking his activities in different countries and services despite the use of VPNs.
- It cannot be disabled from the settings panel and only changes through a complete reinstallation of the operating system.
Sometimes we think that by using a VPN on Windows or deleting cookies we're invisible online, but the reality is that Windows has a trick up its sleeve that leaves us quite exposed. We're talking about the Global Device Identifier, or GDID , a kind of digital license plate that the operating system assigns to each installation and which, until very recently, was an open secret kept under wraps by Microsoft.
This issue has come to light in the most unexpected way possible, specifically through an FBI court file related to the cybercriminal group Scattered Spider. What began as a criminal investigation has ended up opening a huge can of worms regarding privacy and telemetry, revealing that Microsoft has the ability to track a device even if the user changes countries or internet connections.
What exactly is GDID?
To put it simply, the GDID is a persistent and unique identifier directly linked to a specific Windows installation. It's not the same as an IP address, which changes depending on the network, or a browser cookie, which you can delete in a second. It's a numerical value that allows Microsoft to distinguish one operating system installation from any other within its internal services.
It's important to clarify that this code can be associated with both a physical computer and a virtual machine . In fact, if you have three different computers running Windows, you'll have three different GDIDs, since the fingerprint is not of the user themselves, but of the system copy installed on the hardware.
How it is generated and where it is hidden
Since Microsoft hasn't released any information or published a detailed technical manual, we've had to resort to reverse engineering and analyzing advanced user traffic . According to this research, the process begins when we link the device to a Microsoft account. At that point, the wlidsvc identity service contacts the company's servers to request a Device PUID.
This number, a 64-bit value assigned remotely , is stored in the Windows registry, specifically in the path HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties under the name LID. Once saved, the Connected Devices Platform service takes over and registers it in the Microsoft Device Directory, adding a "g" to the beginning to give it the final format GDID.
The key to catching a hacker
The danger of this system was demonstrated in the arrest of Peter Stokes , a suspected member of Scattered Spider. He attempted to cover his tracks using proxies and VPNs from various countries, but the GDID was the thread the FBI followed. Agents discovered that, although the IP address changed, the device identifier remained the same each time he accessed services like ngrok, Snapchat, or Facebook.
- GDID allowed connecting points between an IP address in Tallinn, Estoniaand another in New York.
- The team's activity was linked to access to accounts of Apple and Ubisoft.
- The persistence of the code allowed for the creation of a exact timeline of the suspect's movements.
The most unsettling aspect is that this tracker survives system updates. There's only one way for the GDID to change: by performing a complete Windows reinstallation from scratch. However, if the user logs back in with the same account, Microsoft can re-link the new installation to the previous one using other ecosystem data.
The debate about privacy and the lack of transparency
This is where things get ugly. While Android and iOS offer clear toggles for managing the advertising identifier, Windows GDID is practically invisible . There's no button in the Settings panel to view it, reset it, or, even better, disable it. Microsoft has only mentioned it very vaguely in the Azure Monitor documentation, treating it as internal data.
Many cybersecurity experts have described this behavior as outright surveillance software. The problem isn't that the system needs an ID to manage licenses or updates, but that it's being used to correlate network activity across different IPs and times without the user's explicit and clear consent.
How can we limit this tracking?
If you're worried about the amount of data Windows sends to Redmond, there are some steps you can take, though they're not foolproof. The most effective option is to use a local account instead of a Microsoft account, which reduces the direct link to your online identity, although the GDID might still exist anonymously.
It's also advisable to go to Settings > Privacy and Security and disable anything related to optional diagnostics, personalized advertising, and cloud content search. For those handling extremely sensitive information, such as journalists or activists, the only real solution is to switch to Linux and browse through Tor, as a commercial VPN isn't enough to bypass GDID.
This digital tagging system demonstrates that absolute privacy in Windows environments is a utopia, as the operating system is designed to maintain a constant connection with its servers. The revelation that a hidden identifier can compromise the anonymity of a VPN highlights the enormous transparency gap between what the user believes they control and what Microsoft actually monitors.