Windows tracks every PC: how the Microsoft GDID secret key works

The recent arrest of 19-year-old hacker Peter Stokes has exposed a mechanism that has raised serious questions among the community: the GDID, which allows Microsoft to track virtually any Windows device. Despite the use of VPN and other anonymization tools, the attacker’s actions were tied to a specific identifier of his PC.

What is GDID and why is it hidden from users

GDID stands for Global Device Identifier. For a long time, Microsoft did not disclose details about its purpose and existence until the information was confirmed during the trial. Essentially, GDID is a unique, permanent key associated with a specific Windows installation. The key is generated on the company’s servers and stored in the operating system registry.

Currently, this mechanism covers about 1.6 billion devices. It is important to note that the key remains unchanged when updating the system, but reinstalling the OS results in the creation of a new identifier. However, historical data about previous GDID associations with accounts is stored on the Microsoft side. There is little to no official documentation except for a brief entry in the Azure Monitor tables where it is mentioned as an internal system tool.

Technical principle of operation of the tracking system

Independent researchers (for example, Zerotrace Lab) have found that the Passport Service requests a unique ID from the server and writes it to the registry. Subsequently, the Windows Connected Devices Platform registers the device in the Microsoft Device Directory Service. GDID is tightly integrated into many Windows features:

• OS activation and license management;
• Working Microsoft Store;
• Clipboard synchronization and Phone Link function;
• Windows diagnostics, including browsing history in the Edge browser (when advanced diagnostics are activated).

In the Stokes case, this played a decisive role: the FBI received the GDID from the company, which made it possible to link the hacker’s network activity to his physical device, even if IP addresses changed around the world.

Is it possible to disable tracking via GDID

At the moment, it is not technically possible to completely block or remove GDID, since it is deeply integrated into system processes. The user can only limit the amount of diagnostic data transmitted, but the identifier will continue to exist in the system and Microsoft database.

How to find out your GDID in 5 seconds?

You can check which GDID is assigned to your device using the command in PowerShell:

$hex = (Get-ItemProperty ‘HKCU:\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties’).LID; “g:$([Convert]::ToUInt64($hex,16))”

Microsoft says this identifier is internal and is not shared with ad networks, but it is available to law enforcement upon formal legal request.