Last month, a significant revelation emerged regarding Microsoft’s Global Device Identifier (GDID), an internal marker that uniquely identifies each Windows installation across various Microsoft services. This information surfaced following an unsealed federal court document, which highlighted the use of the GDID in conjunction with telemetry data during investigations into a member of the Scattered Spider cybercrime group.
Understanding the GDID
The GDID is a server-generated identifier that Microsoft characterizes as a persistent device-level marker linked to a specific Windows installation. Unlike a computer’s name or hardware serial number, the GDID is designed to remain constant across supported Microsoft services, allowing for the tracking of activities from the same Windows installation. However, there is currently no built-in option within Windows to disable or regenerate this identifier manually.
In light of these developments, VPN provider Windscribe has introduced a free utility named deGDID. This tool aims to permanently remove the GDID from Windows systems, effectively preventing its recreation. Windscribe emphasizes that simply deleting the registry value is insufficient, as Windows will automatically regenerate the GDID by re-establishing a connection with Microsoft’s servers. Notably, using a local account does not circumvent the creation of the GDID.
Functionality of deGDID
Windscribe’s deGDID operates by removing the existing GDID while simultaneously blocking Windows from generating a new one. It achieves this through the following methods:
- It blocks known Microsoft registration pathways by managing a section of the Windows hosts file, reinforced with Windows Firewall rules.
- It wipes known local GDID-related states across various identity locations, including target-user,
SYSTEM, and.DEFAULT, as well as token device IDs, device tickets, Credential Manager entries, and caches associated with theConnectedDevicesPlatformandTokenBroker.
This open-source tool operates without altering Windows system files. However, Windscribe clarifies that while deGDID can remove the GDID from the local system, it cannot erase any historical records Microsoft may already have linked to the device. The primary goal is to prevent the future issuance of a new GDID once the existing one has been eliminated.
Usage and Considerations
Windscribe provides clear instructions for users: to inspect the status of the GDID, one can use .degdid.ps1 -Status; to redact information before sharing, .degdid.ps1 -Status -Redact is recommended; and for the standard protection process, .degdid.ps1 -Protect should be employed. This process includes blocking the GDID, verifying the block, wiping local state, and ultimately reporting the outcome.
While Windscribe has not encountered issues during testing, it does caution that disabling GDID generation may impact Microsoft services reliant on device identification. The tool is reported to be compatible with all versions of Windows 11 (from 21H2 to 25H2) and Windows 10 version 22H2.
For those interested in exploring this utility, deGDID is available for download from Windscribe’s GitHub repository, where the source code can also be reviewed for transparency regarding its modifications.
It is important to note that while disabling or limiting GDID-related features can enhance privacy, it may also reduce certain personalization, diagnostics, or service functionalities. Fortunately, the tool supports an undo feature, allowing users to revert changes by running .degdid.ps1 -Unprotect in an elevated Command Prompt, similar to the process of enabling it.
