GitHub - gd03gd031/Windows-GDID-Changer: A script that requests the generation of a new GDID from Microsoft servers and assigns it to the Windows installation. · GitHub
/" data-turbo-transient="true" />
Skip to content
Search or jump to...
Search code, repositories, users, issues, pull requests...
-->
Search
Clear
Search syntax tips
Provide feedback
--><br>We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted
Cancel
Submit feedback
Saved searches
Use saved searches to filter your results more quickly
-->
Name
Query
To see all available qualifiers, see our documentation.
Cancel
Create saved search
Sign in
/;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up
Appearance settings
Resetting focus
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
gd03gd031
Windows-GDID-Changer
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>3 Commits<br>3 Commits
README.md
README.md
gdid-regenerator.ps1
gdid-regenerator.ps1
View all files
Repository files navigation
GDID-Changer
Script that regenerates GDID assigned to your windows installation. It works by removing existing sessions and forcing new device registration. Resulting in issuance of new GDID from Microsoft servers.
Requires an internet connection. A new GDID is usually issued instantly, but script needs around 30–90 seconds to complete the job.
Use caution on domain-joined systems or managed environments. Removing device registration data may affect identity, authentication, management, or organizational enrollment states.
The script can force issuance of a new GDID even on the same hardware, but changing hardware identifiers before re-registration is recommended (see the end of this page).
Tested in a local virtual machine environment on Windows 11 using a local account. The device registration process was confirmed by intercepting network traffic.
Background
GDID became publicly discussed after it was mentioned in the Peter Stokes indictment:
https://www.justice.gov/usao-ndil/media/1450651/dl?inline
According to a Microsoft<br>representative, a Global Device Identifier in the Windows ecosystem is a persistent,<br>device-level identifier designed to uniquely identify an installation of a Windows<br>operating system on a device, either a physical device (e.g., a mobile phone or laptop)<br>or virtual machine, across certain Microsoft services and scenarios. A GDID is<br>a globally unique identifier tied to the installation of Windows on a device. A GDID<br>remains consistent across Windows operating system updates on a device , but a<br>reinstall of Windows, either on the same device or on a different device, will be tied<br>to a new unique GDID
What is GDID and how is it generated?
GDID (Global Device Identifier) is a persistent identifier generated by Microsoft servers based on hardware information collected from a Windows installation.
The device registration process occurs on both Windows 10 and Windows 11 systems.
The identifier is normally generated once after Windows installation and then persisted locally as part of Windows device identity. It remains associated with that installation unless the registration state is removed and the device performs registration again.
The process happens automatically after Windows installation, even without signing in with a Microsoft Account.
After Windows installation, the device performs a device registration process.
Windows sends a device registration request to:
https://login.live.com/ppsecure/deviceaddcredential.srf
The request contains multiple hardware-related identifiers, including BIOS information, system identifiers, storage information, and TPM-related data.
Example structure:
BASE64_ENCODED_PAYLOAD<br>BASE64_ENCODED_PAYLOAD<br>BASE64_ENCODED_TPM_DATA
">DeviceAddRequest><br>DeviceInfo Id="DeviceInfo"><br>Component name="4097">BASE64_ENCODED_PAYLOADComponent><br>Component name="4112">BASE64_ENCODED_PAYLOADComponent><br>Component name="TPM">BASE64_ENCODED_TPM_DATAComponent><br>DeviceInfo><br>DeviceAddRequest>
Each component identifier corresponds to a specific hardware data source. Refer to the table at the end of this page for additional details and descriptions of each component.
Microsoft servers process this information and return a GlobalDeviceID.
Example:
00XXXXXXXXXXXXX">GlobalDeviceID>00XXXXXXXXXXXXXGlobalDeviceID>
The returned GDID is a hexadecimal identifier. Windows stores this identifier locally as part of device identity information.
When converted from hexadecimal to decimal, it produces the value shown in the indictment...