script Archives

Winsage

August 9, 2026

This VPN firm has created a way to stop Microsoft’s hidden tracking tool on Windows — although it will break some key cloud services

Windscribe has developed an open-source script called deGDID to remove Microsoft's Global Device Identifier (GDID) from Windows systems. The script functions as a firewall against the DeviceAdd endpoint, preventing Microsoft identity services from recognizing the machine as registered. It includes a flag, -Unprotect, to restore default settings if needed. Testing on a Windows 11 machine confirmed its effectiveness, with the -Status flag showing cached identifiers before removal. The tool is compatible with antivirus and endpoint protection but has limitations: it cannot delete keys stored on Microsoft's servers, cannot run on managed systems or domain-joined accounts, and Windows does not provide a built-in method to disable GDID. The identifier persists across IP addresses, regardless of VPN use. Windscribe notes that the script may disrupt certain Microsoft account functionalities, making it a partial solution rather than a comprehensive fix.

Winsage

August 7, 2026

Permanently disable Microsoft’s hidden tracker on all Windows 11 versions with this script

Microsoft's Global Device Identifier (GDID) is an internal marker that uniquely identifies each Windows installation across Microsoft services. It is a persistent device-level identifier that remains constant across supported services, and there is no option to disable or regenerate it manually. Windscribe has developed a free utility called deGDID to permanently remove the GDID from Windows systems and prevent its recreation. This tool operates by blocking Microsoft registration pathways and wiping local GDID-related states without altering system files. While it can remove the GDID from the local system, it cannot erase historical records linked to the device. Windscribe provides instructions for using the tool, which is compatible with Windows 10 version 22H2 and all versions of Windows 11 from 21H2 to 25H2. Users should be aware that disabling GDID generation may impact Microsoft services that rely on device identification, but the tool includes an undo feature to revert changes.

Winsage

August 6, 2026

VPN provider built a script to block Microsoft’s hidden GDID tracking on Windows — Windscribe’s “deGDID” erases existing identifiers and blocks new ones from being created

Microsoft's Global Device Identifier (GDID) was instrumental in the FBI's arrest of an alleged hacker, raising privacy concerns among advocates. In response, Windscribe launched an open-source project called "deGDID," which removes the GDID from users' PCs but may disrupt certain Microsoft cloud services. The deGDID script can be executed via PowerShell and includes three execution flags: –Status (checks if GDID is active), –Status –Redact (logs with GDID redacted), and –Protect (removes GDID and prevents new identifiers). Users have reported effective functioning of the script, though it can cause issues with Microsoft applications. Windscribe notes that deGDID is a research project that will evolve, but it may not eliminate all GDID instances, and Microsoft retains access to previous keys.

Winsage

August 4, 2026

Microsoft never learns, IT admins rage as a new OneDrive app invades Windows 11 and keeps coming back when you remove it

Microsoft has begun silently installing the "OneDrive Photos" app on Windows PCs, including enterprise systems managed via Microsoft Intune, without prior notification. IT professionals have expressed significant frustration over this unexpected addition, noting that the app is incompatible with Entra accounts and cannot be removed without uninstalling OneDrive entirely. The app functions as a web-based gallery feature, indexing and displaying photos stored on local machines, but its necessity is questioned due to the existing Microsoft Photos app. OneDrive Photos is linked to the OneDrive sync client, making it impossible to uninstall independently. Users have reported that the app appears in Windows Search results with an 'Uninstall' option but does not show up in the Installed apps page, leading to confusion. A script has been developed to remove the shortcut, but it often reappears due to its connection with the OneDrive sync client. Discussions with Microsoft suggest that the rollout may have been unintended, with an apology expected soon.

Tech Optimizer

August 4, 2026

Automated PII redaction for Amazon RDS for PostgreSQL audit logs

The article discusses a serverless pipeline for creating an irreversibly redacted and queryable archive of Amazon RDS for PostgreSQL audit logs. It sanitizes sensitive information, such as Social Security numbers, credit card details, and email addresses, before storing the clean logs in Amazon S3, which can be queried using Amazon Athena. The deployment process is facilitated by a single AWS CloudFormation template. The challenge is that pgAudit logs sensitive data in cleartext to Amazon CloudWatch Logs, which poses compliance risks under regulations like GDPR and HIPAA. While CloudWatch Logs Data Protection offers reversible masking of PII, this is insufficient for compliance needs requiring permanent separation of PII from audit evidence. The proposed pipeline creates an irreversibly redacted copy stored in Amazon S3, ensuring original values cannot be restored. The deployment requires an active AWS account with specific permissions, AWS CLI v2, a compatible AWS region, and confirmation of service quotas. The CloudFormation template has four main parameters for deployment, including ProjectName, DBInstanceClass, DBAllocatedStorage, and EnvironmentType, with sensible defaults provided. Three deployment options are available: via the AWS console, AWS CLI, or a deploy script. After deployment, users can generate test data, trigger the redaction pipeline, and verify results in Athena. The process includes steps to create a PostgreSQL table, insert records with PII, run queries, and monitor the execution of the redaction pipeline. The article emphasizes that unredacted PII remains in the source CloudWatch Logs, recommending enabling CloudWatch Logs Data Protection for added security. To clean up resources and avoid charges, users must empty the S3 buckets and delete the stack. Cost considerations for the pipeline include infrastructure costs and the expense of achieving irreversibility.

Winsage

August 3, 2026

Meet deGDID: Windscribe’s answer to the Windows tracker that VPNs cannot mask

Windscribe has introduced deGDID, a tool aimed at countering the Global Device Identifier (GDID), a Windows tracking mechanism that can trace user activities despite VPN usage. The GDID is a persistent identifier assigned to individual Windows installations, remaining unchanged through updates but reset during a clean reinstallation. It can link telemetry data and browsing history to a specific device, allowing Microsoft to track users across different sessions. deGDID works by modifying the hosts file and implementing firewall rules to prevent Windows from retrieving the GDID and to erase local identity artifacts. Users can download and execute the degdid.ps1 script from GitHub in PowerShell, which includes options for checking status, blocking the GDID, and reversing changes. The tool is not designed for corporate machines and may disrupt access to services like Xbox and Outlook due to its firewall rules. Windscribe warns that it cannot guarantee the complete eradication of GDID pathways or existing records held by Microsoft.

Winsage

August 2, 2026

You should deep clean your Windows PC every year to keep it running smoothly — here’s how I do it

Maintaining the performance of a Windows 11 computer requires regular care, particularly in software management. An annual deep clean is recommended, with the following steps to improve performance: 1. Uninstall Apps: Use BCUninstaller to remove unnecessary applications, including those from the Microsoft Store, with a bulk uninstall feature and a post-uninstallation cleanup for leftover files. 2. Run a Debloat Script: Utilize tools like Chris Titus Tech's Windows Utility to disable unnecessary bloatware and manage telemetry settings. 3. Disable Startup Apps: Access the Task Manager to disable non-essential applications that launch at startup, improving boot times. 4. Check for Driver Updates: Ensure drivers are up to date through Windows Update and check graphics driver websites for the latest versions. 5. Run a Malware Scan: Use Malwarebytes for deep scans to identify and remove potential malware threats. 6. Delete Temporary Files: Clear temporary files through the Settings app and clean up web browser cached files to free up space.

AppWizard

July 31, 2026

Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies

Bitsight's investigation revealed that inexpensive Android TV boxes are being shipped with applications that can change their hardware identity, allowing them to impersonate popular smartphone brands like Samsung and Huawei. This operation, named Fuyao, is linked to Zhejiang Fengwo IoT Technology Co., Ltd., a Chinese company established in 2019. The H96MAXV11 model was frequently reported among the affected devices. In one day, the operation received 65,957 reports from about 38,000 unique MAC addresses, with many devices misidentified as phones due to spoofed identifiers. Fengwo has also promoted over 120,000 "AI digital humans," though details on this marketing term are vague. The command-and-control server for Fuyao sends phone profiles to devices, masking their actual hardware specifications. The operation uses machine vision technology and a YOLOv8s object-detection model to identify advertisements. Bitsight documented 40 fraud tasks, 21 unique campaigns, and 166 modules across four devices. The operation's payout structure involves 144 operator-owned domains, with an estimated gross return of .25 per device daily, potentially leading to annual revenues in the millions. Attribution to Fengwo is supported by shared TLS certificate data and public patent records, although the patents do not directly address advertising. There is uncertainty about how the fraudulent apps were installed and at what point in the supply chain they were introduced. Device owners are advised to verify Play Protect certification and disconnect suspicious devices.

AppWizard

July 29, 2026

Google Play’s got a new system for letting apps deliver age-appropriate experiences

Google Play is launching its Age Signals API globally, allowing parents to share their children's age ranges without revealing personal information. This API enables developers to customize app experiences based on broad age categories (0-12, 13-15, 16-17, and 18+), enhancing age-appropriate interactions. Users retain control over the age data shared, and parents can disable the feature if desired. The API has already been rolled out in Brazil and will expand to Canada and Australia soon, with a global launch expected by the end of the year. Developers are required to use age-related data solely to improve user experiences, with restrictions against using it for advertising or analytics.

Tech Optimizer

July 28, 2026

ClamAV Setup: Linux Antivirus in 12 Steps [2026]

Malware can threaten Linux systems, which are often mistakenly believed to be immune to viruses. It can be introduced through email attachments, infected files, or compromised plugins, especially when Linux servers interact with Windows clients or handle internet uploads. ClamAV is an open-source antivirus engine maintained by Cisco Talos, designed for scanning mail traffic and file uploads. As of mid-2026, the stable release is ClamAV 1.5.x, with version 1.5.2 being the latest patch. To deploy ClamAV, users need root or sudo access on a compatible Linux machine, at least 2 vCPUs and 2GB of RAM, 5GB of free disk space, and outbound HTTPS access to ClamAV’s signature mirrors. The installation process involves several steps, including configuring freshclam for automatic updates, validating detection with the EICAR test file, and setting up cron jobs for regular scans. ClamAV can also be integrated with mail servers and a SIEM for enhanced security. Common pitfalls in deployment include skipping the initial freshclam run and using clamscan instead of clamdscan for repeated scans. ClamAV is free for commercial use and can also scan Windows systems, although it does not replace comprehensive endpoint protection solutions.