A federal court filing unsealed this week has laid bare a little-known Windows identifier that can link a device’s activity across Microsoft services, even when a user employs a VPN. The Global Device Identifier, or GDID, helped investigators tie an alleged cybercriminal to a specific Windows installation, according to the documents. The revelation puts a spotlight on a persistent, installation-level tracking mechanism that most Windows users never knew existed.
What the Court Filing Actually Revealed
The case involves an alleged operator of the Scattered Spider cybercrime group. According to the complaint, Microsoft records showed that a particular GDID was associated with the creation of an ngrok tunneling account, which was then used in unauthorized access and data exfiltration from a luxury jewelry retailer. Crucially, that account was set up through a VPN proxy, yet investigators still managed to connect it to a single Windows device.
In the filing, a Microsoft representative described the GDID as a “persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device, either a physical device or virtual machine, across certain Microsoft services and scenarios.” The ID is stable through operating system updates but is replaced with a new unique GDID after a clean Windows reinstallation. It is not a hardware-bound fingerprint derived from components like the motherboard or CPU.
The GDID isn’t new; it’s been referenced in enterprise-facing Azure Monitor documentation related to Delivery Optimization. But the court filing provides the clearest public description yet of its intended role and investigative value. It shows that under certain circumstances, Microsoft can associate a GDID with timestamps, IP addresses, and specific online actions—such as visiting a sign-up page—when those actions involve Microsoft services or infrastructure.
What This Means for Everyday Windows Users
This isn’t a story about a “spy chip” or a universal tracker that follows you across the entire internet. The GDID operates within the Microsoft ecosystem—its power lies in correlation. A VPN can hide your home IP address from a website, but it won’t hide your device’s GDID from Microsoft if you’re using services that transmit it. In the scattering digital clues that modern online life generates, the GDID becomes a thread that can stitch together seemingly separate pieces of activity.
For the average home user, the practical implication is twofold. First, it reinforces that privacy is not just about network location; it’s about the identifiers your device broadcasts to its own platform vendor. Second, it means that Microsoft has a durable link between your PC and actions taken within its ecosystem—updates, cloud services, account sign-ins, diagnostics, and possibly more. That link persists until you reinstall Windows, and with it the potential to build a long-term activity graph.
For IT administrators and enterprise users, the GDID is a double-edged sword. It aids in asset tracking, security investigations, and compliance. But it also creates a data trail that demands careful governance. The identifier can appear in Delivery Optimization reports, Azure Monitor tables, and other management tools. Without clear documentation, organizations may struggle to assess privacy impact or respond to data subject requests involving the GDID.
Developers building Windows applications that integrate with Microsoft services should be aware that the GDID may be transmitted behind the scenes. While it doesn’t replace user consent or account-based identifiers, it adds a system-level constant that could complicate anonymization efforts.
How We Got Here: A Brief History of Windows Telemetry
Windows telemetry has been a flashpoint for years. With Windows 10, Microsoft introduced mandatory diagnostic data collection, though it later allowed a “Required” baseline. Optional diagnostic data can include broader usage patterns, browsing information, and enhanced error reporting. Alongside this, Windows has long maintained advertising IDs, account identifiers, activation tokens, and hardware-based signals.
The GDID existed quietly in the background, mentioned only in niche technical documentation. It wasn’t until July 2026, when the Techaeris site reported on the court filing, that the identifier entered mainstream discussion. Since then, privacy advocates have drawn parallels to a “permanent cookie” that users cannot delete, while Microsoft has not issued a consumer-facing explainer.
This opacity feeds a growing trust deficit. Windows 11’s deeper integration of Microsoft accounts, OneDrive, AI features, and cloud-powered experiences already makes some users uneasy. The GDID revelation landed awkwardly on top of that, just as the tech industry wrestles with broader questions about device fingerprinting and user consent.
What to Do Now: Practical Steps to Limit GDID Exposure
You can’t switch off the GDID with a simple toggle, and unsupported registry hacks promising to remove it often break critical features like the Microsoft Store or Windows activation. Instead, focus on minimizing the data that gets attached to the identifier and reducing unnecessary cloud linkage.
1. Set diagnostic data to Required
Go to Settings > Privacy & security > Diagnostics & feedback, and select Required diagnostic data. This cuts back the volume of optional telemetry that might be associated with your GDID. It won’t eliminate all device identifiers, but it’s a sensible baseline.
2. Disable tailored experiences
In the same menu, turn off Tailored experiences. This prevents diagnostic data from being used to customize tips, ads, and recommendations—reducing one more revenue of correlation.
3. Use the Diagnostic Data Viewer
Enable the viewer from the diagnostics settings, then launch it from the Start menu. It won’t show you the raw GDID, but it will let you inspect the types of events being sent. That transparency helps you gauge what your configuration choices actually affect.
4. Audit your Microsoft account usage
If you sign in to Windows with a Microsoft account, your GDID can be linked to your profile across devices and services. Consider switching to a local account if you don’t need cloud sync, or at least sign in only to specific apps. Review which apps have account access under Settings > Privacy & security > Account info.
5. Sync only what you truly need
Disable settings sync for Windows, OneDrive folder backup, and Edge sync under Settings > Accounts > Windows backup and Sync your settings. For browsers, use separate profiles for different contexts—work, personal, sensitive research—to avoid cross-contamination.
6. Tighten app permissions
Walk through Settings > Privacy & security and revoke permissions for location, camera, microphone, contacts, and background activity for apps that don’t need them. This doesn’t touch GDID directly, but it reduces the breadth of data that can be linked to your installation.
7. Consider a clean reinstall as a reset option
Because a clean Windows installation generates a new GDID, reinstalling (not resetting through Settings) effectively resets the identifier. This is drastic and requires backing up your data, but it’s the only documented way to get a fresh GDID without hardware changes. For extreme privacy cases, it’s a nuclear option.
Outlook: The Push for Transparency Will Only Grow
The GDID episode isn’t likely to be the last time a system-level identifier sparks public debate. Microsoft faces mounting calls to document exactly which services use the GDID, what data gets linked to it, how long the associations are retained, and whether any user-facing controls can be introduced. Regulators, particularly in the EU, may take an interest given the identifier’s persistence and the difficulty of exercising data subject rights without clear visibility.
Meanwhile, some privacy-conscious users are looking harder at Linux distributions—a shift that Techaeris’s own author cited as their response to this revelation. For most Windows users, though, the immediate path is about informed mitigation: cut unnecessary cloud ties, audit settings, and demand better documentation from the platform vendor that hosts your digital life.