Microsoft services Archives

Winsage

July 12, 2026

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing

Microsoft has confirmed the existence of the Global Device Identifier (GDID), a unique identifier assigned to Windows installations, in a federal complaint against an alleged member of the Scattered Spider hacking group. The GDID is generated when a Windows system is set up with a Microsoft Account and remains active through various Windows updates. Disabling the GDID could disrupt Windows activation and access to Microsoft Store applications. The GDID is described as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device." It is created during the provisioning of Windows with a Microsoft Account and is stored in the Windows registry under HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties. The GDID remains persistent through Windows updates but is not retained after a clean reinstall. A single user can possess multiple GDIDs linked through their account, OneDrive, and activation history. The FBI used the GDID to track Peter Stokes, an alleged member of the Scattered Spider group, across various VPN connections and proxy servers. The GDID was recorded visiting specific websites and was linked to Stokes's accounts on platforms like Snapchat and Facebook. Concerns have been raised regarding user privacy, as the GDID is assigned without user consent and cannot be disabled without compromising essential Windows features. Microsoft has not committed to providing user-facing controls or comprehensive documentation for everyday users regarding the GDID. Legal requests can compel Microsoft to disclose GDID activity data to law enforcement. The GDID is linked to the Microsoft Account rather than the device itself, meaning reinstalling the operating system does not sever this connection.

Winsage

July 11, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes allegedly used sophisticated methods to obscure his identity during a breach at a luxury retailer, but the FBI uncovered his identity through a Global Device Identifier (GDID) linked to his Windows installation. GDID is a persistent device-level identifier that uniquely identifies a Windows installation and remains unchanged through operating system updates, only resetting upon complete reinstallation. Users cannot disable GDID, and attempts to remove it may disrupt Windows activation. To minimize data associated with GDID, users can opt for a local account, limit diagnostic telemetry, disable Activity history, and be cautious during reinstallation. VPNs do not prevent Microsoft from logging GDID, IP addresses, and URLs, making them ineffective for privacy on Windows. GDID has been described as a covert tracking beacon, and security experts advise against using Windows for sensitive tasks, suggesting alternatives like Linux.

Winsage

July 10, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes is involved in a breach with a luxury retailer, using tactics like VPNs and rotating IP addresses to hide his digital activity. The FBI discovered a Global Device Identifier (GDID) linked to his Windows installation, which is a persistent device-level identifier that uniquely identifies Windows installations. GDID remains unchanged through operating system updates but resets with a full reinstallation. Disabling GDID is not possible, as attempts to do so would disrupt Windows activation. Users can minimize data linked to GDID by using a local account, reducing diagnostic telemetry, disabling Activity history, and carefully managing reinstalls. VPNs do not prevent Microsoft from logging GDID, IP address, and URL data. Privacy researchers view GDID as a covert tracking mechanism, and Windows lacks user-facing options to reset this identifier, unlike Apple and Google.

Winsage

July 10, 2026

You can’t fully disable Microsoft’s GDID Windows 11 tracker, but these settings limit what it captures

A 19-year-old named Peter Stokes was detained at Helsinki airport in April 2026 while traveling to Japan, carrying two 2TB hard drives. He was subject to an Interpol Red Notice and faced a federal complaint from U.S. prosecutors by July for his alleged involvement in the Scattered Spider hacking group, which breached a U.S. luxury jewelry retailer in May 2025, leading to a ransom demand. The Global Device Identifier (GDID), developed by Microsoft, is a persistent identifier that uniquely identifies a Windows installation on a device. It links online activities back to a single identity, which law enforcement can use to trace a device's owner. The GDID is generated when a user signs into Windows with a Microsoft Account and remains through updates but does not survive a clean reinstall. Stokes' use of the same Windows device allowed investigators to trace his activities through the GDID, which linked him to the hacking incident. Privacy advocates have raised concerns about the lack of consent for GDID assignment and the potential for surveillance.

Winsage

July 7, 2026

Microsoft Windows telemetry identified hacker despite VPN use

Microsoft's telemetry capabilities helped identify Peter Stokes, a 19-year-old suspected member of the Scattered Spider hacking group, despite his use of a VPN. The investigation revealed a significant cybersecurity breach in May 2025 at a luxury jewelry retailer, leading to the theft of approximately 77 GB of sensitive data and a ransom demand. Investigators linked Stokes to the breach through a Global Device Identifier (GDID) associated with a Windows device that created an ngrok account used in the attack. This device accessed various online platforms and shared IP addresses with Stokes' accounts on Apple, Snapchat, and Facebook, corroborated by travel records and social media posts. The evidence included server logs from Scattered Spider's infrastructure and records from ngrok and other providers.

AppWizard

June 23, 2026

Play Chaos Cubed with Minecraft Realms

The AdventureCraft add-on for Minecraft introduces features such as spell casting, magical weapons, dungeons, and dragon riding. Players can earn a free trial for Minecraft Realms by watching live streams on Twitch or TikTok. The trial is available from June 18th to July 18th and is specifically for Realms Plus on Minecraft: Bedrock Edition. A valid Microsoft account and internet access are required, and players must complete a viewing challenge to receive a redemption code. Each Microsoft account is limited to one trial code, which applies to both Bedrock and Java accounts. Subscription terms apply, and the trial will automatically continue at the regular price unless canceled. Existing users of Realms Plus Server 3 will receive an additional month, while new users will receive a separate trial month. Geographic limitations and other restrictions may apply.

Winsage

June 22, 2026

Windows 11 version 26H2: Microsoft details rollout strategy

Microsoft is enhancing its enterprise offerings with Microsoft Intune, a cloud-based service for managing mobile devices and applications. Intune allows IT administrators to control device usage, ensuring compliance with corporate policies, securing sensitive data through application management, and providing employees with flexible access to corporate resources from personal devices. Additionally, Microsoft promotes Microsoft Learn, an educational platform to help users understand Intune and other services.

Winsage

June 20, 2026

I used Windows 11 exactly the way Microsoft wanted, and it drove me crazy

The author customized their Windows experience by changing the default browser, decluttering the Start menu, and preventing OneDrive from managing their files. They recently set up Windows 11 on a new mini PC and initially allowed OneDrive to back up their files, which led to confusion about file locations. They found Windows Search frustrating, as it redirected them to Microsoft's web version despite choosing a different search provider. The author refrained from altering Microsoft's recommended defaults, which made the system feel more aligned with Microsoft's agenda rather than their own needs. After three days, they reverted to their usual practices to regain control over their Windows experience.

Winsage

June 20, 2026

Microsoft is killing the Microsoft account lock-in across products, Windows 11 may be next

Microsoft is introducing a feature in Microsoft Edge that allows users to sign in with a Google account, expected to roll out in July 2026 for Windows and macOS. This change signifies a shift from the previous requirement of a Microsoft account for various services. Users will see their Gmail address on the Edge profile card after signing in, and synchronization will be enabled. Microsoft has also allowed users to create a Microsoft account using a Gmail address, although this option was not widely known. Additionally, Microsoft is considering removing the mandatory Microsoft account sign-in during the Windows 11 setup process, responding to user feedback. The introduction of Google account sign-in aims to attract Chrome users and ease their transition to Edge.

Winsage

June 18, 2026

Microsoft kills mandatory MSA Edge sign‑in after years of complaints, and Google login support will arrive in July

Users will soon be able to sign into Microsoft Edge using a Google account, according to a new entry in Microsoft's roadmap (ID 565860). This change eliminates the requirement for a Microsoft account, increasing accessibility. Additionally, Microsoft Edge will adopt a two-week release cycle for major updates, similar to Google Chrome, to enhance innovation and competitiveness.