GDID: The Windows Tracker That Defeated a Hacker's VPN

The Case That Exposed a Hidden Identifier

In April 2026, Finnish authorities arrested Peter Stokes, a 19-year-old alleged member of the Scattered Spider hacking group, in Helsinki. Stokes had been careful. He used VPNs. He routed his traffic through proxy servers. He rotated IP addresses across three countries. By conventional measures, he had done everything right to hide his identity online.

The FBI found him anyway — not through his IP address, not through his browsing history, but through something called a Global Device Identifier, or GDID. The identifier, which Microsoft had assigned to his Windows PC when he signed into his Microsoft account, had been silently transmitted to Microsoft's servers during his activities. When the FBI subpoenaed Microsoft, they received logs showing that device identifier "g:6755467234350028" had been used to create an ngrok account used in a hack of a jewelry retailer, visit the victim's website, log into his Snapchat, Facebook, and Apple accounts, and access gaming accounts on Growtopia and Ubisoft — all correlated across four countries over eight months. His VPN had hidden his IP address. It had not hidden his device.

The GDID had been publicly unknown before this court filing. Microsoft had published exactly one sentence about it, buried in Azure Monitor documentation. Most Windows users have never heard of it. And yet it was logging their device's activities and transmitting that data to Microsoft the entire time.

What GDID Actually Is

The Global Device Identifier is a persistent, device-level identifier that Microsoft assigns to every Windows installation when you sign into a Microsoft account. It is stored in the Windows registry under HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties, in a value called "LID." Microsoft's own description, from that single sentence of documentation, calls it "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device."

The technical mechanism works like this: when you sign into Windows with a Microsoft account, a service called wlidsvc communicates with login.live.com and receives back a Device PUID — a Passport Unique ID. The Connected Devices Platform (a component called cdp.dll, running as CDPSvc) reads that PUID and registers it with Microsoft's Device Directory Service. A component called Delivery Optimization then reports it back to Microsoft as UCDOStatus.GlobalDeviceId. The result is a unique identifier, formatted as "g:" followed by a decimal number, that is tied to your specific Windows installation and your Microsoft account.

Unlike an IP address, which changes when you switch networks or use a VPN, the GDID is constant. It survives Windows updates. It persists across different network connections, different VPNs, different countries. The only thing that changes it is a clean reinstall of Windows — and even then, Microsoft can link the new GDID back to the same Microsoft account, effectively re-identifying the device.

The Privacy Problem Nobody Consented To

What makes GDID particularly troubling from a privacy perspective is not just what it does, but how it was implemented. There is no consent screen for GDID. When you sign into Windows with a Microsoft account, you are not informed that a persistent device identifier is being created and transmitted to Microsoft. There is no opt-out. There is no setting that disables it without breaking core Windows functionality.

Compare this to how other platforms handle similar identifiers. Apple's IDFA — the Identifier for Advertisers used on iOS — requires explicit user consent through the App Tracking Transparency prompt. Android's advertising ID can be reset by the user at any time, and users can opt out of personalized advertising entirely. Microsoft implemented GDID with none of these protections. It was assigned automatically, logged silently, and disclosed publicly only because it appeared in a criminal court filing.

The implications extend beyond law enforcement. Microsoft's transparency reports do not detail when or to whom GDID data is disclosed. The company's privacy policy is broad enough to cover disclosure to "law enforcement or other government agencies" in response to legal requests — but the scope of those requests, and the retention period for GDID logs, is not publicly known. For anyone who has reason to be concerned about surveillance — journalists, activists, abuse survivors, and yes, streamers who have been targeted by stalkers — this is a meaningful and largely invisible risk.

What You Can Actually Do About It

The honest answer is that you cannot fully eliminate GDID if you use Windows with a Microsoft account. What you can do is reduce the amount of data that flows to Microsoft and understand the limits of what privacy measures actually protect you.

The most significant step is switching to a local Windows account instead of a Microsoft account. When you use a local account, the GDID mechanism is not triggered in the same way — the wlidsvc service doesn't authenticate with Microsoft's servers, and the device registration process doesn't occur. Microsoft has made this increasingly difficult to do during Windows setup, actively steering users toward Microsoft accounts, but it remains possible. During installation, you can disconnect from the internet before reaching the account setup screen, which forces Windows to offer a local account option.

If you're already using a Microsoft account and don't want to switch, the next best step is reducing the telemetry that Windows sends to Microsoft. Go to Settings > Privacy & Security > Diagnostics & Feedback and set it to "Required only" — this is the minimum level that Windows Home and Pro will allow. Turn off the advertising ID under Settings > Privacy & Security > General. Disable Activity History and Location. If you have Windows Recall enabled, disable it — Recall is a feature that takes screenshots of everything you do and stores them locally, and it represents a significant privacy risk independent of GDID.

For users in enterprise environments or running Windows LTSC (Long-Term Servicing Channel), Group Policy provides more control. The setting "Allow Diagnostic Data" can be set to "Diagnostic data off (Security)" in enterprise editions, which reduces telemetry more aggressively than the consumer settings allow.

The Limits of These Protections

It's important to be clear about what these mitigations do and don't accomplish. Reducing telemetry settings limits how much data Windows sends to Microsoft during normal operation — but it does not eliminate the GDID, and it does not prevent Microsoft from receiving the identifier when you use Microsoft services. If you use a Microsoft account to sign into Office, OneDrive, Xbox, or any other Microsoft service, that activity is associated with your GDID regardless of your privacy settings.

VPNs, as the Scattered Spider case demonstrated, do not protect against GDID. A VPN hides your IP address from the websites you visit and from your ISP. It does not hide your device identifier from Microsoft, because that identifier is transmitted through the Microsoft account authentication process, not through your browsing traffic.

For people who need genuine anonymity — not just privacy — the only reliable approach is to use a non-Windows operating system that doesn't have this kind of persistent device registration. Linux distributions like Tails or Whonix are designed specifically for this use case. For most streamers and content creators, this level of separation is not necessary or practical. But it's worth understanding that Windows, as a platform, has a persistent identifier tied to your device that your VPN cannot hide.

What This Means for Streamers

For the streaming and VTuber community, the practical implication of GDID is this: if you use Windows with a Microsoft account, and if you are ever the subject of a law enforcement investigation or a legal request to Microsoft, your device's activities can be correlated across different accounts, different networks, and different countries. This is relevant not just for people engaged in illegal activity — it's relevant for anyone who has been targeted by a stalker who might attempt to use legal mechanisms to obtain information, or for anyone who operates in a jurisdiction where the legal protections for online privacy are weak.

The more immediate practical concern is understanding the limits of your privacy setup. If you use a VPN because you believe it makes you anonymous, the GDID discovery should prompt a reassessment of that belief. A VPN is a valuable tool that hides your IP address and encrypts your traffic from your ISP. It is not a complete anonymity solution, and it never was. Combining a VPN with a local Windows account, reduced telemetry settings, and careful attention to what Microsoft services you use is a more complete approach — even if it's still not perfect.

Explore all PrivacyWarden guides