A VPN Provider Built a Tool to Strip Windows' Hidden Device ID
Windscribe, a VPN provider, published research on July 27, 2026 into a Microsoft-issued identifier called the Global Device Identifier, or GDID, and released a companion PowerShell tool called deGDID to inspect and remove it on unmanaged Windows systems. The identifier is not new, but it entered public view through a federal criminal filing where Microsoft-supplied logs reportedly tied a specific GDID to IP activity across separate accounts and services, including activity behind a VPN connection.
- Tool released
- deGDID, PowerShell
- Windscribe, 27 Jul 2026
- Public trigger
- Stokes complaint unsealed
- US DOJ, 1 Jul 2026
- Where GDID sits
- Outside the VPN tunnel
- Windscribe research
- Microsoft doc name
- GlobalDeviceId, UCDOStatus table
- Microsoft Learn
What GDID is, and what it is not
Microsoft publicly documents GlobalDeviceId in its UCDOStatus reference table, used for Windows Update for Business and Delivery Optimization reporting, describing it as a device identifier generated by Microsoft and used internally. Windscribe's research states GDID is distinct from an advertising ID, a Microsoft account user ID, and a hardware serial number. Its own testing indicates the identifier is minted through Windows identity and account-registration flows, with hardware signals feeding the request rather than determining it outright; reinstalling Windows produces a new GDID rather than restoring the old one.
How it surfaced in a federal case
GDID became public through a superseding complaint against Peter Stokes, a 19-year-old alleged member of the Scattered Spider hacking group, unsealed by federal prosecutors on July 1, 2026. Windscribe's post states that Microsoft supplied investigators logs correlating a Windows GDID with IP activity, including the creation of an ngrok account at the same minute an intrusion began, and IP addresses tied to personal accounts prosecutors attribute to Stokes, in some instances within hours of each other. Windscribe is careful to note the public record does not identify the exact Windows component or event that produced those logs, and it does not claim GDID is transmitted to every website a user visits; its stated claim is narrower, that GDID can exist on a machine, that Microsoft can associate it with account and network activity, and that common local-privacy advice tends to ignore it.
Why deleting one registry key does not remove it
Windscribe's lab testing found that a local Windows account, one that had never minted a GDID, stayed clean only while the registration path itself was actively blocked; removing the block let a real GDID appear again shortly after. The company also reports that removing the obvious registry value, an entry it calls the LID, was not sufficient on its own: after a reboot, a related account-level identifier called the user PUID reappeared even while the LID stayed blocked. Windscribe describes related identity state spread across IdentityCRL locations, token fields, device tickets, Credential Manager entries, and user profile caches, meaning a single deletion does not break identity continuity the way many "debloat" scripts assume.
What deGDID actually does
The deGDID tool, published to GitHub, is described by Windscribe as deliberately narrow: it targets known local GDID state on supported unmanaged Windows systems and then blocks the Microsoft DeviceAdd path so Windows cannot immediately mint or retrieve a replacement. It does not erase Microsoft's server-side historical records, does not support managed or domain-joined machines, and does not guarantee every possible GDID copy is gone. The tool refuses to run on domain-joined, Entra-joined, MDM-enrolled, or ambiguous multi-profile systems, requires administrator rights, and backs up what it modifies to support an undo path. Windscribe warns that blocking the underlying Microsoft identity paths can degrade features tied to a Microsoft account, including sign-in flows, Microsoft Store, Xbox, OneDrive, device sync, passkeys, and Windows Hello, describing the tradeoff explicitly rather than presenting the tool as a free toggle.
This sits within a broader pattern of operating-system-level identifiers that persist independent of network-layer privacy tools like VPNs, covered in more general terms in Hardware Surveillance: Microphones, Cameras and Telemetry. Windscribe's post frames GDID as one entry in a longer list that includes advertising IDs, hardware hashes, service tokens, and device registration records, most of which are not addressed by tunneling network traffic through a VPN alone.
Sources
Frequently Asked Questions
What is Windows GDID?
GDID, or Global Device Identifier, is a Microsoft-issued identifier tied to a Windows installation. Microsoft documents it publicly as GlobalDeviceId in the UCDOStatus table used for Windows Update for Business and Delivery Optimization reporting. It is not the same as an advertising ID, Microsoft account user ID, or hardware serial number, and it can survive attempts to remove it because it is minted through Windows identity and account-registration flows rather than derived purely from hardware.
How did GDID become public?
GDID appeared in a superseding federal complaint against Peter Stokes, a 19-year-old alleged member of the Scattered Spider hacking group, unsealed July 1, 2026. According to Windscribe's reading of the filing, Microsoft supplied investigators logs correlating a Windows GDID with IP activity, including an ngrok account creation at the same time as an intrusion and IP addresses tied to personal accounts prosecutors attribute to Stokes.
Does a VPN protect against GDID tracking?
No, not by itself. Windscribe's writeup states plainly that in the Stokes case the VPN did not fail and the GDID never traveled through the tunnel. It operates at the layer where Windows communicates directly with Microsoft's cloud, outside VPN-tunneled traffic, so a single connection with the VPN off, or a personal Microsoft account signed into the same machine, can still link the same device identity together.