Windows Tracks You With a Hidden ID. So We Built deGDID to Block It.
Get Windscribe
Must-Reads
Announcements
Opinions
Technical
Informative
Technical
Windows Tracks You With a Hidden ID. So We Built deGDID to Block It.
Curtis Chanders
July 27, 2026
Windows has obvious identifiers, like your computer name, and less obvious ones buried in Microsoft's identity systems. One of the more interesting ones is the Global Device Identifier, or GDID: a Microsoft-issued identifier tied to a Windows installation.<br>GDID is not new, but it recently got dragged into public view in the superseding complaint against Peter Stokes, a 19-year-old alleged member of the Scattered Spider hacking group. According to the filing which was unsealed on July 1st, Microsoft gave investigators logs that correlated a Windows GDID with IP activity. In the past you could guess something like this was happening behind the scenes, but now we have it confirmed in a sworn federal affidavit: a stable identifier inside a giant cloud ecosystem that can connect more dots than most people realize.<br>What is GDID?<br>Microsoft publicly documents GlobalDeviceId in the UCDOStatus table for Windows Update for Business and Delivery Optimization reporting, defining it as a device identifier generated by Microsoft and used internally. That confirms the ID exists but it does not explain much to normal Windows users like your grandma.<br>GDID is not the same as your advertising ID, Microsoft account user ID, or a simple motherboard serial number. Our research suggests the server-issued ID is minted through Windows identity and account-registration flows, with hardware signals involved in the request. Hardware alone does not determine it, though. Reinstall Windows and the machine gets a brand new GDID, so the ID cannot simply be derived from your serial numbers.<br>Why it matters<br>Stable identifiers are not automatically evil. Operating systems use device identity for updates, fraud prevention, licensing, sync, account security, abuse response, and diagnostics. Microsoft also documents extensive optional diagnostic data in Windows.<br>The privacy issue starts when a durable Windows installation ID can be associated with IP addresses, account activity, SmartScreen or browser events, update delivery data, and other telemetry. The Stokes complaint shows how far that association reaches. Microsoft records tied the GDID to the creation of an ngrok account at the exact minute the intrusion began, and to the same IP addresses used by personal accounts prosecutors say belong to Stokes, sometimes within hours of each other. That covers signups on third-party services, and investigators got all of it with a legal request.<br>Worth spelling out, since we sell one: the VPN in this case did not fail. The GDID never saw through the tunnel. It sat outside it, at the layer where Windows talks to Microsoft's cloud, and it tied every session together no matter which IP the traffic came from. One connection with the VPN off, or one personal account signed in on the same machine, and the whole chain links back to you.<br>To be clear, we are not claiming GDID is sent to every website you visit. The public case does not identify the exact Windows component or event that produced the logs. The careful claim is narrower: GDID can exist on your machine, Microsoft can associate it with activity, and local privacy advice often ignores it.<br>Local accounts are not enough<br>A lot of people assume identifiers like this only appear if you sign into Windows with a Microsoft account. Our lab work says otherwise.<br>In one experiment, a local-account virtual machine that had never minted a GDID stayed clean while the registration path was blocked. When the block was removed, a real GDID appeared shortly afterward, carrying the same 0018... prefix you see when you convert the identifier from the Stokes complaint into hex. Blocking it again stopped the re-mint.<br>"Just use a local account" is a common Windows privacy tip, and it still cuts down on account-linked exposure, but our testing shows it is not a GDID shield. The likely mint path is Microsoft Passport or Microsoft Account DeviceAdd, especially login.live.com/ppsecure/deviceaddcredential.srf, with Windows identity components handling the request.<br>Why one registry delete is not enough<br>If there is an ID in the registry, the tempting fix is to delete the obvious value and move on. We tried that. It wasn't enough.<br>Our early wipe removed the obvious value, a registry entry called the LID. After a reboot, a related account-level identifier called the user PUID came back even while login.live.com stayed blocked. That PUID is a separate identifier from the device-level GDID, and its reappearance shows how much identity state Windows keeps in reserve. We found related state across IdentityCRL locations, token fields, device tickets, Credential Manager entries, SYSTEM and .DEFAULT hives, and user profile caches like ConnectedDevicesPlatform and...