- The GDID is a unique and persistent code that identifies each Windows installation, affecting both physical hardware and virtual machines.
- It is generated through internal Microsoft services and remains intact after system updates, although it changes with a clean installation.
- Their ability to link activities across different IPs and VPNs was key for the FBI to track cybercriminals.
- There is no official option to disable it without compromising system activation or the use of the Microsoft Store.
You've probably had the feeling that your computer knows too much about you, but we're not talking about typical browser cookies or ads that keep following you. It turns out that Windows hides a component called GDID (Global Device Identifier) that acts like a kind of digital license plate. The most shocking thing is that, while many telemetry features can be turned off, this Windows GDID identifier is a tough nut to crack and can't be disabled without bricking your system.
This issue has gone from being a technical secret to a topic of national debate following a legal battle in the United States. Essentially, it has been discovered that Microsoft uses this code to uniquely identify each software installation, regardless of whether you're using a physical PC or a virtual machine. For many, this is a useful management tool, but for security experts, it's a persistent tracker that hasn't been fully disclosed.
What exactly is GDID and how does it work?
To clarify, the GDID isn't an IP address or a cookie you can delete by clearing your browsing history. It's a 64-bit identifier that Microsoft servers assign to your computer. It's automatically created when you set up Windows with a home account, although independent research suggests there's an anonymous path even if you use a local account, meaning the system still has a way of recognizing you.
The technical process is quite interesting. It all starts with the wlidsvc service , which contacts the login.live.com servers to request a PUID (Passport ID). Once the system receives this value, it saves it to the Windows registry (specifically in the IdentityCRL path), and then the Connected Devices Platform (CDPSvc) comes into play. Finally, this code, which usually begins with the letter 'g' followed by numbers , is used in services like Delivery Optimization to inform Microsoft about PC updates.
The case that changed everything: The trail of Scattered Spider
If GDID hadn't been so effective, it would probably still be a footnote in a technical manual. However, the FBI used it to catch Peter Stokes , an alleged member of the Scattered Spider hacking group. Stokes thought he was safe using proxies and VPNs to hide his location while attacking a luxury jewelry store, but GDID betrayed him.
Agents discovered that, although the IP address constantly changed depending on the suspect's location, the device identifier remained the same. This allowed the FBI to connect disparate dots: from a connection in Estonia to accesses in New York and Thailand. By cross-referencing the GDID with logins to Snapchat, Facebook, and Apple , investigators were able to piece together an exact timeline of his movements, demonstrating that a VPN is essentially a band-aid if the operating system already has your digital fingerprint on file.
Privacy under scrutiny: Is there anything we can do?
This is where things get tricky. Unlike Android or iOS, where you can reset your advertising ID, Windows doesn't have a toggle switch for the GDID. Microsoft says it's required for system activation and for the Microsoft Store to function properly. If you try to forcibly delete it, you'll most likely end up with an unactivated Windows and apps that won't open.
Even so, there are some ways to try and reduce tracking. The best option is to use a local account , since even though the GDID remains, the link to your real identity is much weaker. It's also a good idea to go into Settings and configure privacy in Windows 11 by disabling optional diagnostic data and personalized ads. Other tips include blocking cloud-based content searches so your local queries don't end up on Bing's servers.
For those operating in high-risk environments, such as activism or journalism, the solution is more drastic. Experts suggest that the only real way to escape this level of surveillance is to abandon Windows and switch to Linux distributions using the Tor network, since GDID is a control tool embedded in the very core of the Microsoft user experience.
What has become clear is that the GDID is an indelible code that survives updates and allows Microsoft (and the authorities) to know exactly which machine is doing what, regardless of how many layers of browser privacy or anonymity we think we've implemented. Even though reinstalling the system from scratch generates a new code, simply logging back in with the same account is enough for the company to link your new installation to your entire previous history, leaving very little room for real privacy.