local account Archives

Winsage

July 29, 2026

I’ve used these 7 shortcuts in Windows 11 more than anything else — stop using Ctrl+Alt+Del and learn something better

- To create a local account in Windows 11, press Shift + F10 to open Command Prompt and enter the command: start ms-cxh:localonly. User creation is possible, and passwords are optional. - To check battery health, open the Start menu, run Command Prompt as administrator, and enter the command: powercfg /batteryreport /output "C:battery_report.html" to generate a report on the C: drive. - To access Task Manager quickly, right-click the Taskbar and select Task Manager or press Ctrl + Shift + Esc. - To enable Clipboard history, press Windows + V. - To access the desktop, press Windows + D or click the blank Taskbar space to the right of the clock. Pressing Windows + , briefly reveals the desktop. - To move off-screen apps on multiple monitors, press Windows + an arrow key, ensuring the desired app is in focus by pressing Alt + Tab if needed.

Winsage

July 28, 2026

Your Windows Recycle Bin is a privacy risk—here’s how to actually delete your files

The Recycle Bin in Windows, introduced in 1995, serves as a temporary storage for deleted files rather than permanently removing them. When a file is deleted, it is moved to the Recycle Bin, which requires manual emptying or activation of a Storage Sense policy to clear its contents. This can lead to reduced hard drive space for users unaware of its behavior. The Recycle Bin can contain sensitive information, and if someone gains access to a Microsoft account, they can view its contents. Even after emptying the Recycle Bin, data can be recovered unless overwritten, with different recovery processes for solid-state drives (SSDs) due to maintenance routines like the TRIM command. Risks extend beyond physical access, as compromised accounts or malware can access deleted files. To securely delete sensitive files, users can use the Shift + Del shortcut, file shredding applications, and consider encrypting their drives with BitLocker. Specialized shredders for SSDs exist, and users can optimize drives through Windows settings to manage data recovery risks.

Winsage

July 26, 2026

Are you the family’s tech support? This Windows security checklist helped put an end to late night panic texts.

- A text message from the author's father prompted a discussion about using a password manager for cybersecurity. - The author's mother had a previous concern about an unexpected "tech support" notification on her computer. - The author created a cybersecurity best practices document to help their parents and others with technology. - Key security vulnerabilities to address include enabling Windows Hello, ensuring Windows Update is running, confirming Windows Defender is on, and turning on the 'Find my Device' feature. - One-time security measures recommended are switching from a local account to a Microsoft account with two-factor authentication, enabling device encryption, switching from a Windows 11 Administrator account to a Standard account, and using a password manager. - Good cybersecurity habits include learning to spot phishing scams, being cautious of unsolicited tech support calls, and avoiding the installation of unsolicited software.

Winsage

July 26, 2026

How I stopped being my parents’ emergency IT hotline — The complete list of Windows Security settings I made them fix once and for all

A family member inquired about the necessity of a password manager, reflecting growing cybersecurity concerns. A parent received a suspicious "tech support" message, indicating potential security risks. Windows Hello allows users to log in with a PIN, fingerprint, or facial recognition on Windows 11 PCs. Users can set it up via Settings > Accounts > Sign-in options. Regular updates through Windows Update are essential for security, and users can check their status in Settings > Windows Update. Windows Defender is the built-in antivirus for Windows 11, typically enabled by default, but users should verify its status in Settings > Privacy & security > Windows Security > Virus & threat protection. The 'Find My Device' feature can be enabled in Settings > Privacy & security > Find my device to track and lock a lost or stolen laptop. Switching from a local account to a Microsoft account with two-factor authentication (2FA) enhances security, accessible via Settings > Accounts > Your info. Device encryption can protect sensitive data, available in Settings > Privacy & security > Device encryption for Home versions and BitLocker for Pro versions. Using a Standard account instead of an Administrator account reduces malware risks, managed through Settings > Accounts > Family. Password managers like NordPass, 1Password, and Bitwarden help generate strong, unique passwords for accounts. Users should learn to spot phishing scams, be cautious of unsolicited tech support calls, and avoid installing software suggested by unknown callers to maintain cybersecurity.

Winsage

July 21, 2026

Persistent Telemetry: Permanent Microsoft Windows Identifier

Discussions about consumer privacy in the Windows ecosystem have focused on optional diagnostic settings and telemetry controls. Recently, the Global Device Identifier (GDID), a permanent device-level token embedded in the Windows operating system, was revealed in a U.S. Department of Justice complaint related to a cybercriminal investigation. The GDID uniquely identifies a Windows installation and is used by Microsoft services. It is generated when a device is linked to a Microsoft account and resides in the Windows registry, being included in data sent to remote servers. There is no option to disable or delete the GDID, and attempts to do so can disrupt essential features. This has led privacy-conscious users to consider alternatives like Linux, which offers more control over data and does not require persistent identifiers. For Windows users, strategies to minimize data linked to the GDID include using local accounts, disabling optional diagnostics, and reviewing cloud app sync settings. Privacy advocates are calling for better user controls and opt-out mechanisms for hardware tracking tokens.

Winsage

July 12, 2026

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing

Microsoft has confirmed the existence of the Global Device Identifier (GDID), a unique identifier assigned to Windows installations, in a federal complaint against an alleged member of the Scattered Spider hacking group. The GDID is generated when a Windows system is set up with a Microsoft Account and remains active through various Windows updates. Disabling the GDID could disrupt Windows activation and access to Microsoft Store applications. The GDID is described as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device." It is created during the provisioning of Windows with a Microsoft Account and is stored in the Windows registry under HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties. The GDID remains persistent through Windows updates but is not retained after a clean reinstall. A single user can possess multiple GDIDs linked through their account, OneDrive, and activation history. The FBI used the GDID to track Peter Stokes, an alleged member of the Scattered Spider group, across various VPN connections and proxy servers. The GDID was recorded visiting specific websites and was linked to Stokes's accounts on platforms like Snapchat and Facebook. Concerns have been raised regarding user privacy, as the GDID is assigned without user consent and cannot be disabled without compromising essential Windows features. Microsoft has not committed to providing user-facing controls or comprehensive documentation for everyday users regarding the GDID. Legal requests can compel Microsoft to disclose GDID activity data to law enforcement. The GDID is linked to the Microsoft Account rather than the device itself, meaning reinstalling the operating system does not sever this connection.

Winsage

July 11, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes allegedly used sophisticated methods to obscure his identity during a breach at a luxury retailer, but the FBI uncovered his identity through a Global Device Identifier (GDID) linked to his Windows installation. GDID is a persistent device-level identifier that uniquely identifies a Windows installation and remains unchanged through operating system updates, only resetting upon complete reinstallation. Users cannot disable GDID, and attempts to remove it may disrupt Windows activation. To minimize data associated with GDID, users can opt for a local account, limit diagnostic telemetry, disable Activity history, and be cautious during reinstallation. VPNs do not prevent Microsoft from logging GDID, IP addresses, and URLs, making them ineffective for privacy on Windows. GDID has been described as a covert tracking beacon, and security experts advise against using Windows for sensitive tasks, suggesting alternatives like Linux.

Winsage

July 10, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes is involved in a breach with a luxury retailer, using tactics like VPNs and rotating IP addresses to hide his digital activity. The FBI discovered a Global Device Identifier (GDID) linked to his Windows installation, which is a persistent device-level identifier that uniquely identifies Windows installations. GDID remains unchanged through operating system updates but resets with a full reinstallation. Disabling GDID is not possible, as attempts to do so would disrupt Windows activation. Users can minimize data linked to GDID by using a local account, reducing diagnostic telemetry, disabling Activity history, and carefully managing reinstalls. VPNs do not prevent Microsoft from logging GDID, IP address, and URL data. Privacy researchers view GDID as a covert tracking mechanism, and Windows lacks user-facing options to reset this identifier, unlike Apple and Google.

Winsage

July 10, 2026

You can’t fully disable Microsoft’s GDID Windows 11 tracker, but these settings limit what it captures

A 19-year-old named Peter Stokes was detained at Helsinki airport in April 2026 while traveling to Japan, carrying two 2TB hard drives. He was subject to an Interpol Red Notice and faced a federal complaint from U.S. prosecutors by July for his alleged involvement in the Scattered Spider hacking group, which breached a U.S. luxury jewelry retailer in May 2025, leading to a ransom demand. The Global Device Identifier (GDID), developed by Microsoft, is a persistent identifier that uniquely identifies a Windows installation on a device. It links online activities back to a single identity, which law enforcement can use to trace a device's owner. The GDID is generated when a user signs into Windows with a Microsoft Account and remains through updates but does not survive a clean reinstall. Stokes' use of the same Windows device allowed investigators to trace his activities through the GDID, which linked him to the hacking incident. Privacy advocates have raised concerns about the lack of consent for GDID assignment and the potential for surveillance.

Winsage

July 9, 2026

GDID Windows – Cut the tracker that follows you even through a VPN

In April 2026, the FBI apprehended an individual associated with the Scattered Spider group, who had concealed his online activities using a VPN. His efforts were thwarted by the GDID, a 64-bit Persistent Unique Identifier assigned by Microsoft upon logging into Windows. The GDID is stored in plain text in the registry and is linked to Microsoft’s servers, remaining unaffected by changes to IP addresses or attempts to delete it. Disabling Windows telemetry does not prevent the GDID from being accessed, as it operates through other services. To mitigate its transmission, users can disable certain services and modify the hosts file, although the GDID itself remains stored on Microsoft’s servers. Scripts are available on GitHub to audit and implement changes regarding the GDID. Transitioning to a local account does not guarantee anonymity, and for sensitive activities, using a live Linux system is recommended for better data control.