- The GDID is a persistent identifier assigned to each Windows installation that allows a device to be tracked regardless of IP address or VPN usage.
- Its existence came to light thanks to an FBI legal process against the Scattered Spider group, demonstrating its ability to correlate data.
- Unlike advertising IDs, the GDID does not have an official off switch and is tied to critical system services and your Microsoft account.
You might feel safe using a VPN or browsing in incognito mode, thinking you're invisible online, but there's a silent guest on your computer that tells a very different story. We're talking about the GDID, or Global Device Identifier , a kind of digital license plate that Microsoft assigns to your system and which, unlike cookies, isn't simply deleted by clearing your browser or changing your proxy server.
This mechanism has gone from being a technical detail buried in internal manuals to becoming the center of a heated debate about privacy . The reason is simple: while an IP address is volatile and can change in seconds, the GDID remains constant, allowing anyone with access to these records to connect the dots of your activity across time and space, without you even realizing it.
What exactly is GDID and how does it work?
To put it simply, the GDID is a unique number linked to a specific Windows installation. It's not a code randomly generated on your PC; rather, it's a 64-bit Device PUID that Microsoft servers (specifically through login.live.com) assign to you when you register your system. Once received, Windows stores it in the registry, specifically in the MicrosoftIdentityCRL path , where it remains readable even without administrator privileges.
This identifier is the key component of modern telemetry. Services like the Connected Devices Platform (CDP) and Delivery Optimization use it to report the device's status. What's most remarkable is that the GDID survives system updates and most hardware changes, although if you perform a clean Windows installation from scratch, the system will generate a new one. However, if you sign back in with your Microsoft account, the company can link the new installation to the old one using other hardware hashes.
The Scattered Spider case: When the GDID exposes a hacker
The world learned of this tracker's existence not through a press release, but through an FBI court file. A 19-year-old, Peter Stokes, an alleged member of the cybercriminal group Scattered Spider , was tracked thanks to this information. Stokes believed he was protected by using proxies and VPNs to attack a luxury jewelry store, but he made a fatal mistake: he used the same device for his criminal activities and his personal social media accounts.
The FBI requested records from Microsoft and discovered that a specific GDID was active at the exact minute an ngrok account used in the attack was created. From there, the reconstruction was surgical. They were able to see that the same identifier was connecting from Estonia, New York, and Thailand , cross-referencing the data with logins to Snapchat, Facebook, and Apple. In the end, the VPN only masked the IP address, but the GDID traveled outside the tunnel , betraying the suspect with every move.
Privacy vs. Functionality: Microsoft's Dilemma
This is where things get ugly. Unlike Android or iOS, where you can reset your advertising identifier with a couple of clicks, Windows doesn't have an off switch for the GDID. Microsoft simply defines it as an internal identifier, but security experts have already labeled it as surveillance software due to the lack of transparency and consent.
The problem is that GDID is so deeply ingrained that trying to remove it completely can break essential functions. Activation tools and Microsoft Store (UWP) apps rely on this identity system. If you block communication with the identity servers, you'll likely stop receiving updates or your Windows license may start malfunctioning, creating a forced dependency between the system utility and persistent tracking.
Is it possible to prevent or mitigate GDID tracking?
If you don't want your PC to be an open book for Redmond's telemetry, there are some measures you can take, though none are a magic bullet. The best option is to use a local account instead of a Microsoft account; while this doesn't completely eliminate the GDID (since the system can generate an anonymous one), it drastically reduces the amount of personal data linked to that number. It's also vital to configure privacy settings in Windows 11 to disable optional diagnostic data and the advertising ID.
For more advanced users, third-party tools have emerged, such as the deGDID PowerShell script developed by Windscribe. This tool attempts to clear the local state of the identifier and block the network paths through which Windows requests a new one. However, caution is advised: this process degrades the user experience , as it can cause OneDrive, Xbox, or Windows Hello to malfunction. For those who require true anonymity, the only viable option is to jump ship and migrate to Linux distributions using Tor.
Comparison with other identifiers
- IP adress: It is temporary and changes depending on the network. The GDID is permanent by installation.
- Cookies: They are stored in the browser and can be deleted. The GDID resides in the operating system kernel.
- Advertising ID: Designed for advertising and can be disabled. The GDID is for internal diagnostics and telemetry.
This global identifier acts as an invisible thread connecting every action of our computer to Microsoft servers, demonstrating that anonymity in Windows is, at best, an illusion. Although there are ways to reduce one's digital footprint and limit data transmission through local accounts or technical scripts, the system architecture is designed so that device identity takes precedence over the user's desire for privacy, relegating transparency to a secondary concern compared to the company's need for control and technical support.