Windows GDID Tracking Cannot Be Disabled; Windscribe Releases Open-Source deGDID Tool
Cybersecurity firm Windscribe has released deGDID, a free open-source tool that blocks Microsoft's Global Device Identifier (GDID) tracking mechanism in Windows. The GDID, a server-generated device-level identifier used across Microsoft services, cannot be disabled through standard Windows settings. US court documents show law enforcement previously used GDID telemetry to trace members of the Scattered Spider cybercrime group. While deGDID cannot erase historical data stored on Microsoft servers, it prevents future identifier generation and is compatible with Windows 11 (21H2-25H2) and Windows 10 22H2.
Microsoft's Windows 11 operating system includes a tracking mechanism called the Global Device Identifier (GDID), generated by Microsoft's servers. It serves as a persistent device-level identifier across multiple Microsoft services and application scenarios, used to correlate and identify activity records from the same Windows device across services. Unlike the computer name or hardware serial number, GDID cannot be turned off through conventional settings. Microsoft acknowledges the identifier's existence in its technical documentation and legal statements, but Windows provides no built-in option for users to independently disable or reset GDID.
Previously declassified documents from US federal courts show that law enforcement agencies combined Microsoft telemetry data with GDID identifiers to successfully track members suspected of involvement in the Scattered Spider cybercrime network. The case revealed GDID's practical application in device identification and activity tracking, with its data records spanning multiple Microsoft services, posing potential implications for user privacy.
Cybersecurity service provider Windscribe has recently released a free open-source tool called deGDID, designed to clear GDID and prevent its regeneration. The tool does not modify Windows core system files. Instead, it blocks known registration paths in the hosts file and, combined with Windows firewall rules, cuts off communication between the device and Microsoft's relevant cloud endpoints. The tool also clears local caches storing GDID state, credential manager records, and device tokens, preventing the system from automatically re-downloading and generating new identifiers.
The deGDID tool cannot erase historical data previously recorded on Microsoft's servers, but it can effectively prevent the issuance of new identifiers in the future. The tool is fully open source on GitHub and supports status checks, protection activation, and restoration through PowerShell commands. Testing shows the tool is compatible with all Windows 11 versions, from 21H2 through 25H2, as well as Windows 10 22H2.