Microsoft has confirmed that every Windows installation receives a persistent identifier—a Global Device Identifier, or GDID—that can uniquely track the device across services, updates, and even different networks. The acknowledgment came after court documents revealed how the identifier helped federal investigators link VPN-routed criminal activity to an alleged member of the Scattered Spider hacking group. And there’s no ordinary privacy switch to turn it off.

The confirmation, buried in a newly unsealed criminal complaint and first publicized by ExtremeTech, has ignited a firestorm among privacy advocates and everyday Windows users alike. It raises a stark question: if you can’t see or disable the tracker, how much does Microsoft know about what you do on your own computer?

What Is the Global Device Identifier?

A GDID is a unique, system-generated number that Microsoft assigns to each install of Windows. It’s not a hardware serial number, and it’s not tied permanently to a specific physical machine—it’s linked to the operating-system installation itself. That means one physical PC can accumulate multiple GDIDs over time if the OS is reinstalled, and virtual machines get their own identifiers as well.

The identifier was described in court filings as “a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system … across certain Microsoft services and scenarios.” It survives routine monthly updates and major feature releases, but a clean Windows reinstall will generate a new one.

Where is it stored? A copy sits on your local machine under the registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties, but server-side association is what gives it teeth. Microsoft’s own technical documentation, spotted by Windows Latest, ties GDID generation to the Microsoft Account Sign-In Assistant service (wlidsvc). Disabling that service may prevent a new GDID from being created or sent, but doing so can break Microsoft account sign-ins, Store access, and even feature updates—as Microsoft’s Intune documentation explicitly warns.

How a Criminal Case Exposed Microsoft’s Tracking

The GDID might have remained an obscure tech detail if not for the arrest of Peter Stokes, a 19-year-old dual U.S.-Estonian citizen prosecutors allege was part of Scattered Spider, a group known for sophisticated social engineering attacks. According to the complaint, Stokes’ Windows device was the common thread that connected his VPN-shrouded online activity to a real-world identity.

Here’s what the court records described: In May 2025, attackers breached a luxury jewelry retailer (called “Company F”) via a social-engineering ploy against the IT help desk. They installed ngrok—a legitimate tunneling tool—to maintain remote access and exfiltrated 77GB of data, demanding $8 million in cryptocurrency. The ransom wasn’t paid, but the company suffered over $2 million in damages.

Investigators found that the ngrok account used in the attack was created from an IP address associated with a VPN proxy. Ordinarily, that would obscure the user’s real location. But Microsoft’s logs showed that the Windows device that signed up for ngrok had a specific GDID. Later, the same GDID appeared at Company F’s website through that very proxy—and then popped up again alongside IP addresses linked to Stokes in Estonia, New York, and Thailand, where travel records also placed him. The convergence of device identity, account information, and real-world movements built the case.

Crucially, the GDID was not the sole smoking gun; it was the adhesive that connected disparate dots. Without it, investigators would have had a much harder time proving that the same person operating behind a VPN was the same individual who traveled to those locations.

Why a VPN Couldn’t Hide the GDID

Many users assume a VPN makes them anonymous online. The GDID case is a sobering reminder that network privacy does not equal application privacy.

A VPN encrypts traffic between your device and the VPN server and masks your public IP address. But if a piece of software on your machine—like a Windows service—reaches out to Microsoft and includes a stable identifier in that communication, the VPN sees only encrypted packets and does nothing to strip the identifier. The GDID, being an installation-level marker, rides above the network layer. It’s like wearing a disguise but carrying an ID card that you show to the person you’re visiting.

This isn’t a flaw in VPNs; it’s a basic architecture reality. Browser cookies, account logins, device fingerprints, and even behavioral patterns can all leak identity across network tunnels. The GDID simply gives Microsoft a consistent, hard-to-avoid way to recognize your Windows installation whenever it talks to the mothership.

What Microsoft’s Identifier Means for Your Privacy

At base, the GDID is a pseudonymous number. Alone, it doesn’t say your name. But Microsoft doesn’t store it alone. It can be linked to your Microsoft account, your IP history, your device’s hardware hash, your Windows Update eligibility, your Store purchases, and—as the court documents suggest—your browsing patterns if telemetry services are collecting that data.

The real shock isn’t that Windows uses an identifier—modern operating systems all do, for licensing, fraud prevention, and updates. The shock is twofold: few users knew about it, and there’s no off switch.

Windows does offer an advertising ID that you can disable in Settings > Privacy & security > General. But that controls a different thing: app access to a separate, resettable identifier for ad targeting. The GDID is foundational; Microsoft’s documentation treats it as necessary for core platform functions. The privacy dashboard lets you see and delete some data, like location history and voice clips, but there’s no equivalent for the GDID or the associations it anchors.

This opacity creates a trust deficit. Microsoft has spent years telling customers that Windows is private by design, with granular controls and “required vs. optional” diagnostic data. Yet a durable installation tracker, powerful enough to help put an alleged hacker in handcuffs, operates entirely outside that consent framework.

Practical Steps to Limit Your Exposure

No consumer action can delete or disable the GDID without destabilizing Windows. That doesn’t mean you’re helpless, though. You can reduce the amount of ancillary data that gets linked to it.

  • Audit your Microsoft account devices. Sign in at account.microsoft.com/devices and remove old or unused PCs and VMs. Each one had a GDID; removing the device from your account severs some of the linkage.
  • Limit optional diagnostic data. In Settings > Privacy & security > Diagnostics & feedback, switch to “Required diagnostic data” if you don’t want to share usage patterns. Note that even “Required” still sends a baseline of telemetry; Microsoft defines its scope, not you.
  • Revisit Edge settings. If you use Microsoft’s browser, check privacy and security options: you can disable search and browsing data sharing, block tracking, and turn off SmartScreen (at the cost of some phishing protection). This reduces URL-level data collection that could be tied to your GDID.
  • Use a local Windows account. When possible, skip the Microsoft account sign-in. A local account still gets a GDID, but it isn’t directly bound to your email, OneDrive, and other cloud services. Be aware that some features (like BitLocker key backup) become unavailable.
  • Separate roles. If you work from home on the same PC you use for personal stuff, consider using distinct browser profiles or even multiple Windows user accounts. Better yet, use a dedicated device or a VM for high-sensitivity tasks.
  • Don’t blindly “debloat.” Social media is rife with scripts that claim to demolish Windows telemetry by disabling dozens of services. Many of those services are critical for security patches or authentication. Break the wrong thing, and you’ll end up with an unsecure system that can’t receive updates—ironically making you more vulnerable.

These measures won’t stop the GDID from being generated, but they shrink the data exhaust that gets attached to it. Think of it as reducing what an omniscient observer can learn about you, even if you can’t erase yourself from their records.

The Backstory: From Windows 10 to Now

Persistent identifiers aren’t new to Windows. Hardware IDs, installation IDs, and Entra device IDs have existed for years. What changed is the public’s awareness, driven by a criminal investigation that turned a background technical artifact into a headline.

Microsoft’s approach to device identity evolved alongside Windows 10’s cloud integration. The Microsoft Account Sign-In Assistant and the Connected Devices Platform service both manage identity and synchronization. The GDID appears to be a newer refinement—one that the company explicitly discusses in enterprise managed-update documentation but never marketed to consumers.

The July 2026 security update (KB5101650) and the Windows 11 builds in active development all continue to use the GDID infrastructure. There’s no indication it will be removed; if anything, Microsoft seems to be deepening its reliance on installation-level identity for security and servicing purposes.

What Microsoft Should Do Next

The GDID controversy is bad for Microsoft’s reputation, but it’s also a solvable problem. The company doesn’t need to get rid of the identifier—doing so would break update management, fraud detection, and account security. But it must bring it out of the shadows.

A responsible disclosure would answer at least these questions:
1. When exactly is a GDID created? Spell out the scenarios for local accounts, Microsoft accounts, domain joins, VMs, and reinstalls.
2. Which Microsoft services use it? Is it Windows Update? Defender? Edge? Office? Store? Users deserve a clear list.
3. How long is data retained? How long do GDID links persist, and what happens to that data when you remove a device from your account or reinstall Windows?
4. Can old and new GDIDs be tied together? If you reinstall, can Microsoft still correlate your activity before and after?
5. Where’s the user-facing audit tool? A supported setting page—even a read-only one—that shows the current GDID and which services have queried it would go a long way toward rebuilding trust.

Regulators in the EU and US are already circling big-tech data practices. A proactive, transparent explanation would cost Microsoft little and could preempt heavy-handed mandates.

The Outlook

The Stokes case won’t be the last time a device identifier makes headlines. As OS-level telemetry grows more sophisticated, the line between security feature and surveillance tool blurs. Windows users are now on notice: the operating system sees your PC as an install identity, and that identity can be traced across time, networks, and services.

For now, the practical advice is to stay informed, reduce unnecessary data sharing where you can, and push Microsoft for clear answers. The GDID isn’t evil, but it’s a reminder that “privacy” and “connected services” are often at odds—and the knobs labeled “privacy” in Settings don’t control everything.