Windscribe has unveiled deGDID, a novel tool designed to combat a specific Windows tracking mechanism that remains impervious to conventional VPN protections. This initiative arises in the wake of a notable US court case, where the Global Device Identifier (GDID) played a pivotal role in tracing a suspect’s activities across various VPNs and international borders.
The GDID, a server-assigned identifier linked to individual Windows installations, was highlighted in this legal context, showcasing its potential to reveal user identities despite the use of VPNs. Investigators utilized logs provided by Microsoft to correlate the GDID with IP activity, effectively tracking the suspect’s machine over a span of eight months.
What Microsoft’s GDID is, and why a VPN won’t help
A Microsoft representative characterized the GDID as a persistent identifier, crafted to uniquely recognize a Windows installation on a device. This identifier remains intact through Windows updates but is reset during a clean reinstallation, which generates a new GDID. The privacy implications arise when this stable ID is linked to telemetry data, Edge browsing history, Microsoft Store transactions, and IP addresses, enabling Microsoft to associate the same device across different sessions and services.
While a virtual private network (VPN) effectively masks IP addresses and encrypts data, the GDID operates outside this protective tunnel. It exists at the layer where Windows communicates with Microsoft’s cloud services, thus maintaining continuity across sessions regardless of the IP address used. Switching to a local Windows account does not mitigate this issue; Windscribe’s testing revealed that a GDID is still created even under a local account. Attempts to manually delete the GDID from the registry resulted in its reappearance upon reboot.
How Windscribe’s deGDID works, and how to use it
Windscribe’s deGDID employs modifications to the hosts file and specific firewall rules to obstruct the pathways Windows uses to retrieve a GDID, while also erasing known local identity artifacts. To utilize this tool, users can download the degdid.ps1 script from GitHub and execute it in PowerShell with administrator privileges. The script offers various options: the -Status flag for a read-only check, -Protect for a comprehensive block and verification routine, and -Unprotect to reverse any changes made.
It is important to note that the tool is intentionally designed not to operate on managed, domain-joined, or corporate machines. During practical testing, the script executed without errors; however, it inadvertently disrupted logins to services such as Xbox, Outlook, and the Microsoft Store due to the firewall rules that also severed connectivity for these platforms. Windscribe cautions that it may also impact OneDrive, passkeys, and Windows Hello functionalities, and it cannot guarantee the identification of every GDID pathway or erase records already held by Microsoft on their servers.
For the average user, this development serves as a reminder of the complexities associated with being a Windows user. Nevertheless, for those seeking to scrutinize or mitigate the effects of the GDID, deGDID stands out as one of the few tools available. Windscribe further suggests that users looking for a more robust solution might consider transitioning to Linux.
