GDID Archives

Winsage

August 28, 2026

“God Mode? Hardly.” Microsoft debunks Windows 11’s God Mode, but the trick still works

The "God Mode" in Windows is activated by creating a folder and renaming it to GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}, which transforms the folder icon to resemble the Control Panel and displays a comprehensive list of all settings tasks available in Windows. This trick was clarified by Microsoft engineer Brandon Paddock, who stated that the name "GodMode" is misleading, as the folder can be named anything with the same CLSID code, and it merely exposes two documented elements of the Windows shell. The functionality was intended for developers and not casual users, and the trick could be altered or removed in future updates.

Winsage

August 19, 2026

Windows 11 is getting a major privacy upgrade, blocks apps spying on your camera and mic with new controls

Windows 11 has introduced individual privacy controls for desktop applications, allowing users to manage access permissions for apps like Chrome and Steam through Settings > Privacy & security. This change enables users to selectively grant or deny access to features such as the microphone, camera, and location for each app, moving away from the previous system where traditional Win32 software was grouped under a single toggle. With the latest Experimental build (26340.9212), apps like Edge and Brave now have separate toggles for microphone, camera, and location access. Additionally, a new centered system dialog prompts users for permission when a desktop app attempts to access the microphone or camera for the first time. These features are still in testing and may not be universally available.

Winsage

August 9, 2026

This VPN firm has created a way to stop Microsoft’s hidden tracking tool on Windows — although it will break some key cloud services

Windscribe has developed an open-source script called deGDID to remove Microsoft's Global Device Identifier (GDID) from Windows systems. The script functions as a firewall against the DeviceAdd endpoint, preventing Microsoft identity services from recognizing the machine as registered. It includes a flag, -Unprotect, to restore default settings if needed. Testing on a Windows 11 machine confirmed its effectiveness, with the -Status flag showing cached identifiers before removal. The tool is compatible with antivirus and endpoint protection but has limitations: it cannot delete keys stored on Microsoft's servers, cannot run on managed systems or domain-joined accounts, and Windows does not provide a built-in method to disable GDID. The identifier persists across IP addresses, regardless of VPN use. Windscribe notes that the script may disrupt certain Microsoft account functionalities, making it a partial solution rather than a comprehensive fix.

Winsage

August 7, 2026

Permanently disable Microsoft’s hidden tracker on all Windows 11 versions with this script

Microsoft's Global Device Identifier (GDID) is an internal marker that uniquely identifies each Windows installation across Microsoft services. It is a persistent device-level identifier that remains constant across supported services, and there is no option to disable or regenerate it manually. Windscribe has developed a free utility called deGDID to permanently remove the GDID from Windows systems and prevent its recreation. This tool operates by blocking Microsoft registration pathways and wiping local GDID-related states without altering system files. While it can remove the GDID from the local system, it cannot erase historical records linked to the device. Windscribe provides instructions for using the tool, which is compatible with Windows 10 version 22H2 and all versions of Windows 11 from 21H2 to 25H2. Users should be aware that disabling GDID generation may impact Microsoft services that rely on device identification, but the tool includes an undo feature to revert changes.

Winsage

August 6, 2026

VPN provider built a script to block Microsoft’s hidden GDID tracking on Windows — Windscribe’s “deGDID” erases existing identifiers and blocks new ones from being created

Microsoft's Global Device Identifier (GDID) was instrumental in the FBI's arrest of an alleged hacker, raising privacy concerns among advocates. In response, Windscribe launched an open-source project called "deGDID," which removes the GDID from users' PCs but may disrupt certain Microsoft cloud services. The deGDID script can be executed via PowerShell and includes three execution flags: –Status (checks if GDID is active), –Status –Redact (logs with GDID redacted), and –Protect (removes GDID and prevents new identifiers). Users have reported effective functioning of the script, though it can cause issues with Microsoft applications. Windscribe notes that deGDID is a research project that will evolve, but it may not eliminate all GDID instances, and Microsoft retains access to previous keys.

Winsage

August 3, 2026

Meet deGDID: Windscribe’s answer to the Windows tracker that VPNs cannot mask

Windscribe has introduced deGDID, a tool aimed at countering the Global Device Identifier (GDID), a Windows tracking mechanism that can trace user activities despite VPN usage. The GDID is a persistent identifier assigned to individual Windows installations, remaining unchanged through updates but reset during a clean reinstallation. It can link telemetry data and browsing history to a specific device, allowing Microsoft to track users across different sessions. deGDID works by modifying the hosts file and implementing firewall rules to prevent Windows from retrieving the GDID and to erase local identity artifacts. Users can download and execute the degdid.ps1 script from GitHub in PowerShell, which includes options for checking status, blocking the GDID, and reversing changes. The tool is not designed for corporate machines and may disrupt access to services like Xbox and Outlook due to its firewall rules. Windscribe warns that it cannot guarantee the complete eradication of GDID pathways or existing records held by Microsoft.

Winsage

July 26, 2026

Microsoft confirms Windows uses persistent device identifier | Tap to know more

Microsoft has confirmed that each installation of Windows is assigned a persistent Global Device Identifier (GDID) that cannot be disabled through standard settings, raising privacy concerns. Investigators have used the GDID to track a cybercriminal, prompting discussions about the balance between security and privacy. Users have expressed concerns about their lack of control over the GDID, and advocates are calling for better mechanisms for managing device-level tracking. There is a demand for greater transparency and user empowerment regarding digital privacy.

Winsage

July 21, 2026

Persistent Telemetry: Permanent Microsoft Windows Identifier

Discussions about consumer privacy in the Windows ecosystem have focused on optional diagnostic settings and telemetry controls. Recently, the Global Device Identifier (GDID), a permanent device-level token embedded in the Windows operating system, was revealed in a U.S. Department of Justice complaint related to a cybercriminal investigation. The GDID uniquely identifies a Windows installation and is used by Microsoft services. It is generated when a device is linked to a Microsoft account and resides in the Windows registry, being included in data sent to remote servers. There is no option to disable or delete the GDID, and attempts to do so can disrupt essential features. This has led privacy-conscious users to consider alternatives like Linux, which offers more control over data and does not require persistent identifiers. For Windows users, strategies to minimize data linked to the GDID include using local accounts, disabling optional diagnostics, and reviewing cloud app sync settings. Privacy advocates are calling for better user controls and opt-out mechanisms for hardware tracking tokens.

Winsage

July 12, 2026

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing

Microsoft has confirmed the existence of the Global Device Identifier (GDID), a unique identifier assigned to Windows installations, in a federal complaint against an alleged member of the Scattered Spider hacking group. The GDID is generated when a Windows system is set up with a Microsoft Account and remains active through various Windows updates. Disabling the GDID could disrupt Windows activation and access to Microsoft Store applications. The GDID is described as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device." It is created during the provisioning of Windows with a Microsoft Account and is stored in the Windows registry under HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties. The GDID remains persistent through Windows updates but is not retained after a clean reinstall. A single user can possess multiple GDIDs linked through their account, OneDrive, and activation history. The FBI used the GDID to track Peter Stokes, an alleged member of the Scattered Spider group, across various VPN connections and proxy servers. The GDID was recorded visiting specific websites and was linked to Stokes's accounts on platforms like Snapchat and Facebook. Concerns have been raised regarding user privacy, as the GDID is assigned without user consent and cannot be disabled without compromising essential Windows features. Microsoft has not committed to providing user-facing controls or comprehensive documentation for everyday users regarding the GDID. Legal requests can compel Microsoft to disclose GDID activity data to law enforcement. The GDID is linked to the Microsoft Account rather than the device itself, meaning reinstalling the operating system does not sever this connection.

Winsage

July 11, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes allegedly used sophisticated methods to obscure his identity during a breach at a luxury retailer, but the FBI uncovered his identity through a Global Device Identifier (GDID) linked to his Windows installation. GDID is a persistent device-level identifier that uniquely identifies a Windows installation and remains unchanged through operating system updates, only resetting upon complete reinstallation. Users cannot disable GDID, and attempts to remove it may disrupt Windows activation. To minimize data associated with GDID, users can opt for a local account, limit diagnostic telemetry, disable Activity history, and be cautious during reinstallation. VPNs do not prevent Microsoft from logging GDID, IP addresses, and URLs, making them ineffective for privacy on Windows. GDID has been described as a covert tracking beacon, and security experts advise against using Windows for sensitive tasks, suggesting alternatives like Linux.