In a federal complaint filed by US prosecutors against an alleged member of the Scattered Spiders hacking group, Microsoft has publicly acknowledged the existence of the Global Device Identifier (GDID), a device-specific ID assigned to Windows installations.
The ID is generated when Windows is set up with a Microsoft account, persists through Windows Update, and cannot be disabled without affecting Windows activation and Microsoft Store apps.
Microsoft briefly mentions the GDID in the Azure Monitor documentation, describing it simply as “an identifier used internally by Microsoft.” The complaint cites a Microsoft representative who describes the GDID as “a persistent, device-level identifier designed to uniquely identify the installation of the Windows operating system on a device, whether a physical device such as a mobile phone or laptop or a virtual machine, across certain Microsoft services and scenarios.”
What is Windows Global Device Identifier and how did the FBI use it
The Global Device Identifier (GDID) is a permanent ID that is assigned when Windows provisions it against a Microsoft account. It is generated by a series of Windows services.
The wlidsvc service requests the device PUID from log.live.com, which is registered by the connected device platform in Microsoft’s device directory service.
Delivery Optimization reports the GDID back to Microsoft when a PC shares or downloads an update. This identifier is stored in the Windows Registry under HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties and is formatted with a lowercase “g” prefix followed by a decimal number.
This is reported to Microsoft servers and persistent in Windows Update, but is not retained after a clean reinstall. Microsoft has acknowledged that a user can have multiple GDID links through their account, OneDrive, and activation history.
The FBI used GDID to track alleged Scattered Spiders member Peter Stokes through VPN connections, proxy servers, and four countries over approximately eight months.
According to the complaint, the GDID g:6755467234350028 was recorded by visiting the ngrok signup page at the same time the account used in the attack was created through the Tzulo VPN proxy. Three hours later, the same GDID accessed the victim retailer’s website through the same proxy.
The device was cross-referenced with IP addresses linked to Stokes’s accounts on Snapchat, Facebook, Apple, and Ubisoft in Estonia, New York, Thailand, and other locations. Stokes’ public Snapchat photos matched hotel bookings, locations and travel timelines associated with GDID.
The persistent nature of GDID in VPN sessions proved to be a key investigative asset. While the VPN IP addresses changed frequently, the underlying Windows installation continued to report the same identifier, aiding investigators in their tracking efforts.
Why privacy researchers are concerned and what users can do
Several security researchers have raised concerns about users’ visibility and control over GDID:
- There is no consent screen when a GDID is assigned. Apple’s advertising identifier requires an App Tracking Transparency prompt with a visible reset. Android offers similar controls. GDID has nothing.
- Activation dependency. Masgrave, the group behind Microsoft Activation Scripts, notes that Windows Setup sends hardware information to Microsoft and receives identifiers back that are later used for store access and licensing. Blocking GDID assignment breaks both activation and the UWP app.
- Reinstalling Windows generates a new GDID, but signing back into the same Microsoft account gives Microsoft a clear path to link the new identifier to the previous activity.
- Microsoft’s public documentation of the identifier includes a sentence in the Azure Monitor reference table for enterprise IT administrators.
Security researcher Matthew Hickey has characterized Windows as “surveillance software” in response to the case. Costin Ryu asked on the Three Buddy Problems podcast how similar functionality exists on other platforms.
Users concerned about the GDID have limited direct options because the identifier cannot be turned off without breaking core Windows functionality. Practical steps to reduce relevant tracking include:
- Use a local account instead of a Microsoft account when possible. Windows 11 has made this harder in recent versions, but the option is still available during setup for users who know how to access it.
- Turn off optional diagnostic data via Settings, Privacy & Security, Diagnostics & Feedback.
- Disable personalized ads and launch tracking under Privacy & Security, Recommendations & Offers.
- To stop local searches from sending data to Bing, turn off Cloud Content Search under Privacy & Security, Search.
- Review and disable Activity History and other telemetry options in Privacy & Security Settings.
- For journalism, activism, or domestic abuse situations where identifier persistence poses a threat, use Linux routed through Tor rather than relying on a commercial VPN with a Windows PC.
Users who reinstall Windows to get a new GDID should be aware that signing back into the same Microsoft account gives Microsoft data linking the new identifier to previous activity.
What does GDID mean for Windows users and how widely deployed is it?
For approximately 1.6 billion Windows users worldwide, GDID is working quietly in the background without any public disclosure or user control. A recent complaint revealed the existence of this identifier, but Microsoft has not committed to providing user-facing controls or documentation for regular users.
Users concerned about device-level tracking should be aware that the identifier is tied to the account, not the device, meaning reinstalling the OS doesn’t break the link.
Most major operating systems maintain some form of persistent device identity for purposes such as licensing and security checks, but Windows differs from platforms such as Apple and Google by not providing visible controls.
Legal requests, such as subpoenas, could force Microsoft to share GDID activity data with law enforcement, as exemplified in the Scattered Spider case. The GDID is present on all Windows installations associated with a Microsoft account.
Users cannot view their own GDID through the standard Windows interface; It is stored in the registry at HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties under the LID key. Microsoft has not indicated any changes to how the GDID is generated, stored, or reported.
The only public reference outside the federal complaint is a brief note in the Azure Monitor document. Users can monitor privacy updates from Microsoft, but the company has not indicated plans to provide more public information about GDID.
The Scattered Spider case is moving through the US federal court system. For those interested in technical details, reviewing the discussion of the Microsoft Telemetry complaint provides the clearest public explanation of how GDID operates to date.
