How a Hidden Windows ID Helped Law Enforcement Trace a Suspect Across Three Continents

A federal criminal complaint unsealed in mid-2025 has pulled back the curtain on a little-known Windows tracking mechanism—a persistent device identifier that can link a person’s proxy-shielded website visits, online accounts, and physical travel across countries. The case, filed against an alleged member of the Scattered Spider hacking group, describes how Microsoft records tied a single Global Device Identifier (GDID) to an ngrok proxy account, a visit to the victim’s website, and network activity in Estonia, New York, and Thailand—all within hours or days.

The disclosure doesn’t prove Windows records every page you visit. But it demonstrates that Microsoft’s server logs, when combined with a stable device identity, can reconstruct a remarkably detailed trail of one computer and, by extension, its user.

The Case That Exposed GDID

In May 2025, a luxury jewelry retailer suffered a cyber intrusion that led to an $8 million ransom demand and millions more in recovery costs. The FBI and international partners eventually arrested 19-year-old dual U.S.-Estonian citizen Peter Stokes in Finland and extradited him to the United States. According to the complaint, investigators used a Windows GDID—g:6755467234350028—to connect dots that an attacker had tried hard to separate.

Here’s what the court filing alleges happened in a single day:
- A new ngrok account, a service often used to tunnel into networks, was created from behind a proxy.
- At the same minute, a Windows installation carrying the GDID accessed the ngrok sign-up page via that proxy.
- Three hours later, the same GDID appeared in connection with a visit to the victim company’s website, again through the same proxy infrastructure.
- Over the following weeks and months, Microsoft’s logs tied that GDID to additional websites, IP addresses, and locations, including a hotel in New York and a residence in Bangkok.

Investigators then cross-referenced these digital breadcrumbs with Apple, Facebook, Snapchat, travel, and photographic evidence attributed to the suspect. The GDID didn’t crack the case alone; it was the glue that held the timeline together.

What a Global Device Identifier Actually Is

Think of GDID as a 64-bit installation fingerprint—not a hardware serial number, but a server-assigned identity that Windows carries from the moment it first connects to Microsoft’s cloud. Independent analysis shows it is closely related to a Microsoft Account infrastructure value called a Device PUID (Passport Unique ID), stored locally in the registry at:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties

The entry, labeled LID, appears as a 16-character hexadecimal number like 0018000FC8CB93CC. When sent to Microsoft services, it gets the g: prefix and decimal form.

Crucially, Microsoft confirmed in the court filing that the identifier remains stable through Windows updates but changes when you reinstall the operating system. That behavior rules out a deterministic hardware hash; it’s a cloud-provisioned number, not one baked into your motherboard or processor.

Several Windows components participate in this chain: the Microsoft Account sign-in service, Connected Devices Platform (CDP), and Device Directory Service. The result is a label that lets Microsoft recognize your PC across sessions, services, and even as you hop between IP addresses and networks.

What It Means for Your Privacy

The power of GDID isn’t in the number itself—it’s in Microsoft’s ability to attach it to a growing file of activity. A GDID alone reveals nothing. But on Microsoft’s servers, it can link together:
- IP address history
- Timestamps
- Windows version and hardware details
- Microsoft account relationships
- URLs accessed (under certain conditions)
- Update and delivery optimization status
- Security alerts and reputation events

In the Stokes investigation, the identifier tied a proxy session to a direct hotel Wi‑Fi connection to a residential network across continents. That continuity is what makes it a powerful investigative tool—and a potential privacy risk.

However, don’t believe every headline. Here’s what the evidence actually supports and what remains unproven:

How to Check Your Own GDID

Open PowerShell and run:

(Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties').LID

To see the decimal version used by Microsoft’s servers (with the g: prefix):

$hex = (Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties').LID
"g:$([System.Convert]::ToUInt64($hex, 16))"

Treat this number like sensitive pseudonymous data. Sharing it publicly could let someone with access to related Microsoft logs correlate activities with your installation.

What You Can Do (and What You Can’t)

Stop looking for an off switch. Windows doesn’t offer a “Rotate GDID” button, and disabling optional diagnostic data won’t delete the underlying identity. GDID is tied to required service communications, including updates, authentication, and the Connected Devices Platform. Even hopping to a local account doesn’t guarantee you won’t receive one.

Your realistic options:
- Reinstall Windows – This is the only documented way to get a new GDID. But be aware: other identifiers (Microsoft account, Entra registration, OneDrive, hardware attributes) can still link the fresh installation to your old history.
- Limit data exposure – Use the Diagnostic Data Viewer to understand what your PC sends. Set diagnostic data to “Required” (Windows 10/11 Settings > Privacy & security > Diagnostics & feedback). Turn off “Tailored experiences.” In Edge, disable optional diagnostic data and consider alternative browsers for sensitive activity.
- Check enterprise settings – If you manage a fleet, inventory where GlobalDeviceId appears in update reports, Delivery Optimization, and security logs. Restrict access to raw identifiers and set defensible retention periods.

None of these steps will erase Microsoft’s existing server records for your device. That ship has sailed—unless Microsoft provides a formal deletion mechanism or a court order compels it.

The Questions Microsoft Must Answer

The GDID disclosure has blown open a gap between Microsoft’s privacy documentation and its operational reality. To rebuild trust, the company should publicly clarify:
- Exactly which services collect, share, and store GDID.
- How long it retains IP, URL, and account histories linked to the identifier.
- Whether the URL-level data in the Stokes case came from Edge diagnostic data, SmartScreen, Defender, or another component.
- Why there is no user-facing control to rotate or delete the identifier.
- How it classifies GDID-linked records when responding to law enforcement (content vs. non-content).
- What happens with cloned virtual machines and golden images.

Until these are answered, every Windows user should operate under the assumption that their device leaves a durable, server-side trail that can survive browser resets, VPN tunnels, and even a local account switch.

What Comes Next

The Stokes case will be watched closely—not just for its cybersecurity drama, but for the precedent it sets. If a U.S. court accepts GDID evidence as reliable, expect law enforcement worldwide to request similar device histories through mutual legal assistance treaties. Meanwhile, criminals will adapt: disposable VMs, frequent reinstalls, and traffic isolation will become more common, potentially chipping away at the identifier’s forensic value.

For Microsoft, the transparency gap is now a liability. The EU’s GDPR and similar laws require clear consent for personal data processing, and a device identifier that can be linked to browsing and location is squarely personal data. Regulatory pressure may force an official rotation mechanism, a public-facing device history dashboard, and stricter data retention limits.

Windows users shouldn’t panic—but they should pay attention. The obscure number sitting in your registry has just become a very public example of how a single durable ID can stitch together a digital life. Whether that’s a necessary evil for security and device management or an overreach waiting for guardrails depends on how loudly users demand answers.