Microsoft Confirms Windows GDID Identifier Cannot Be Disabled
Microsoft has confirmed the existence of the Global Device Identifier (GDID), a persistent ID assigned to Windows installations linked to a Microsoft Account. The identifier, described in a federal complaint against a hacker group, remains active through updates and cannot be disabled without disrupting Windows activation and app access. Microsoft’s brief mention of GDID in Azure Monitor documentation labels it as “an identifier used internally,” but the FBI’s use of the ID in tracking a suspect highlights its operational significance.
FBI’s Use of GDID in Tracking a Suspect
The GDID is generated when Windows provisions against a Microsoft Account, with data flowing through services like wlidsvc and the Connected Devices Platform. It is stored in the Windows registry under HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties, prefixed with a lowercase “g.” The FBI leveraged this persistence across eight months to track Peter Stokes, an alleged member of the Scattered Spider group, despite his use of VPNs and proxies. The same GDID, g:6755467234350028, appeared during a Tzulo VPN sign-up and later on a victim’s website, cross-referenced with IP addresses tied to Stokes’s social media accounts.
While IP addresses change frequently, the GDID’s consistency across sessions allowed investigators to trace activity across Estonia, New York, Thailand, and other locations. Public photos from Stokes’s Snapchat account aligned with hotel bookings and travel timelines linked to the ID, highlighting its value as a tracking tool. Microsoft has acknowledged that multiple GDIDs can be linked to a single account through activation history and OneDrive.
Related: Meta Releases Muse Spark Update in US
Privacy Concerns and User Options
Security researchers have raised alarms over GDID’s lack of user controls. Unlike Apple’s App Tracking Transparency or Android’s advertising ID, GDID is assigned without a consent prompt. Blocking it breaks Windows activation and Universal Windows Platform (UWP) apps, as noted by the Massgrave group. Reinstalling Windows generates a new GDID, but logging back into the same account allows Microsoft to link the new ID to previous activity.
Microsoft’s public documentation of GDID is minimal, limited to a single sentence in Azure Monitor references. Security researcher Matthew Hickey called Windows “surveillance software” in response to the case. Users seeking to reduce tracking can opt for local accounts instead of Microsoft Accounts, disable diagnostic data, and turn off personalized ads.
The GDID is stored in the registry under HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties. Microsoft has not indicated plans to change its generation or provide user-facing controls. Legal requests, such as subpoenas, can compel Microsoft to share GDID data with law enforcement, as seen in the Scattered Spider case.
