?VPN Provider Fights Microsoft's Hidden Windows Device Tracking?
https://www.pcmag.com/news/vpn-provider-fights-microsofts-hidden-windows-device-tracking-gdid
?Windscribe VPN creates an experimental computer script that removes the mysterious Global Device ID (GDID) from a Windows PC, though it does
break some functionality.?
A hacker?s arrest exposed a little-known way Microsoft can track users
on a Windows PC, but VPN provider Windscribe says it developed a process
to shut it down.
https://www.pcmag.com/news/a-hackers-arrest-reveals-microsoft-can-track-users-via-a-windows-device
Windscribe says its experimental computer script can remove the Global Device ID (GDID) from a Windows PC. That identifier was used by the FBI
to identify 19-year-old Peter Stokes, an alleged member of the hacking
group Scattered Spider. Agents uncovered that an IP address associated
with his hacks was linked to Stokes?s Windows PC through the 16-digit GDID.
https://www.pcmag.com/news/notorious-hacking-group-scattered-spider-targets-us-airlines
Removing anything from Windows is dangerous as Windows has always struck
me as a fragile environment.
Lynn McGuire <lynnmcguire5@gmail.com> wrote:
?VPN Provider Fights Microsoft's Hidden Windows Device Tracking?
https://www.pcmag.com/news/vpn-provider-fights-microsofts-hidden-windows-device-tracking-gdid
?Windscribe VPN creates an experimental computer script that removes the
mysterious Global Device ID (GDID) from a Windows PC, though it does
break some functionality.?
A hacker?s arrest exposed a little-known way Microsoft can track users
on a Windows PC, but VPN provider Windscribe says it developed a process
to shut it down.
https://www.pcmag.com/news/a-hackers-arrest-reveals-microsoft-can-track-users-via-a-windows-device
Windscribe says its experimental computer script can remove the Global
Device ID (GDID) from a Windows PC. That identifier was used by the FBI
to identify 19-year-old Peter Stokes, an alleged member of the hacking
group Scattered Spider. Agents uncovered that an IP address associated
with his hacks was linked to Stokes?s Windows PC through the 16-digit GDID. >>
https://www.pcmag.com/news/notorious-hacking-group-scattered-spider-targets-us-airlines
Removing anything from Windows is dangerous as Windows has always struck
me as a fragile environment.
In the registry, look at:
For currently logged in Windows account:
Key: HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties
Data item: LID
Data value: unique GDID string per Windows account
For all Windows accounts: HKEY_USERS\*\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties
Data item: LID
Data value: unique GDID string per Windows account
?VPN Provider Fights Microsoft's Hidden Windows Device Tracking?
https://www.pcmag.com/news/vpn-provider-fights-microsofts-hidden-windows-device-tracking-gdid
?Windscribe VPN creates an experimental computer script that removes the mysterious Global Device ID (GDID) from a Windows PC, though it does
break some functionality.?
A hacker?s arrest exposed a little-known way Microsoft can track users
on a Windows PC, but VPN provider Windscribe says it developed a process
to shut it down.
https://www.pcmag.com/news/a-hackers-arrest-reveals-microsoft-can-track-users-via-a-windows-device
Windscribe says its experimental computer script can remove the Global Device ID (GDID) from a Windows PC. That identifier was used by the FBI
to identify 19-year-old Peter Stokes, an alleged member of the hacking
group Scattered Spider. Agents uncovered that an IP address associated
with his hacks was linked to Stokes?s Windows PC through the 16-digit GDID.
https://www.pcmag.com/news/notorious-hacking-group-scattered-spider-targets-us-airlines
Removing anything from Windows is dangerous as Windows has always struck
me as a fragile environment.
Lynn
Lynn McGuire <lynnmcguire5@gmail.com> wrote:
?VPN Provider Fights Microsoft's Hidden Windows Device Tracking?
https://www.pcmag.com/news/vpn-provider-fights-microsofts-hidden-windows
-device-tracking-gdid
?Windscribe VPN creates an experimental computer script that removes
the mysterious Global Device ID (GDID) from a Windows PC, though it
does break some functionality.?
A hacker?s arrest exposed a little-known way Microsoft can track
users on a Windows PC, but VPN provider Windscribe says it developed a
process to shut it down.
https://www.pcmag.com/news/a-hackers-arrest-reveals-microsoft-can-track-
users-via-a-windows-device
Windscribe says its experimental computer script can remove the Global
Device ID (GDID) from a Windows PC. That identifier was used by the FBI
to identify 19-year-old Peter Stokes, an alleged member of the hacking
group Scattered Spider. Agents uncovered that an IP address associated
with his hacks was linked to Stokes?s Windows PC through the 16-digit
GDID.
https://www.pcmag.com/news/notorious-hacking-group-scattered-spider-targ
ets-us-airlines
Removing anything from Windows is dangerous as Windows has always
struck me as a fragile environment.
In the registry, look at:
For currently logged in Windows account:
Key: HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties
Data item: LID
Data value: unique GDID string per Windows account
For all Windows accounts: HKEY_USERS\*\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties
Data item: LID
Data value: unique GDID string per Windows account
If you use an MS account login, you'll also find your stored MS identity under:
HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities
Windscribe mentions that disabling/blocking the GDID can result in
unwanted side effects.
https://www.ghacks.net/2026/07/12/microsoft-confirms-windows-gdid-device- identifier-that-cannot-be-disabled-documented-in-fbi-case-filing/
"The ID is generated when Windows is set up with a Microsoft Account, persists through Windows updates, and cannot be disabled without
affecting Windows activation and Microsoft Store apps."
What is unclear is if you get a GDID if you do *not* subscribe to an MS account, like you create a local/offline Windows account instead of
linking it to an MS account.
"The Global Device Identifier (GDID) is a permanent ID assigned when
Windows provisions against a Microsoft Account. It is generated by a
chain of Windows services.
The wlidsvc service requests a Device PUID from login.live.com, which is
then registered into Microsoft's Device Directory Service by the
Connected Devices Platform."
The article mentions how the GDID is used, for example, with the
Delivery Optimization feature (which I disabled, but I do login under an
MS account). Other users noted the GDID is also used by OneDrive (which
I do use).
"Blocking GDID assignment breaks both activation and UWP apps."
"Users concerned about GDID have limited direct options because the identifier cannot be turned off without breaking core Windows
functionality."
Probably why Windscribe flags their GDID-blocking script as experiments
since it could have deleterious side effects. So, how does a server get
the GDID of a visiting client?
"While VPN IP addresses change frequently, the underlying Windows installation continued reporting the same identifier, aiding
investigators in their tracking efforts."
Hmm, "reporting" the GDID. Seems that would be Javascript in a web page trying to get at attributes on the client-end of a network connection.
I don't recall the GDID is part of any HTTP header when a client
connects to a server, so how else would the server get the GDID?
Javascript still works through a VPN.
"Users concerned about device-level tracking should be aware that the identifier is attached to the account, not the device, meaning
reinstalling the OS does not break the link."
Some users state a clean install of Windows is needed to get a new GDID.
But that means they still have the GDID. Seems the cure is NOT to login
into Windows using an MS account, and instead login to a local/offline Windows account and forego any conveniences the link to an MS account
affords to you. Nope, you get a GDID even without signing into an MS account.
down.
GDID appears only used by Microsoft in tracking updates to devices,
Onedrive synchronization, [update] delivery optimization, or for other
MS services. What is missing in the articles about GDID is how it got
sent when the baddy registered an account at ngrok, or how any site can extract the GDID without something on the client end providing it upon request. How do you defend when the mechanism for data transfer is not exposed?
Microsoft has your GDID. But how did the feds force Microsoft to
correlate the times of URLs for website visits to the GDIDs that MS has?
To do so means Microsoft must somehow be tracking your website visits.
Users tend to forget, or never know, that everywhere they visit is
tracked by Google should the user leave SafeBrowsing enabled which is
used in most web browsers. SafeBrowsing is a Google service that gets
the URL of where you visit, and then decides if it is okay or not.
https://en.wikipedia.org/wiki/Google_Safe_Browsing
I leave it enabled, but then I *know* Google is tracking to where I
visit. While presented as a safety feature, most users don't realize it
is also a tracking feature.
And don't forget you can be fingerprinting using an aggregate hardware identification:
https://superops.com/tech-hub/what-is-hwid
Who knows what Microsoft is tracking of you that the feds could use to
find you.
Yep. I don't have a MS account, but I do have a GDID at the registry location you cite, above.
Boris <Boris@invalid.invalid> wrote:
Yep. I don't have a MS account, but I do have a GDID at the registry
location you cite, above.
Even if you delete the LID registry entry, Windows recreates it on a
reboot. A fresh install would generate a new GDID, except Microsoft
still has the old one, and now a new one, and they'll track you through
each GDID you generate. They don't need an MS account, but can track whatever GDID you have by their services reporting your GDID for many features users do want, like updates, especially security updates.
The GDID isn't just used with an MS account for sync purposes. It is
also used for updating, OneDrive, license control, and many other uses.
The regeneration of the GDID means MS services are creating it. You
can't get rid of GDID unless you switch to Linux.
Using a local/offline Windows account does not eliminate the creation,
use, and reporting of your GDID to Microsoft.
On Thu, 30 Jul 2026 22:44:13 -0500, VanguardLH <V@nguard.lh> wrote:
Boris <Boris@invalid.invalid> wrote:
Yep. I don't have a MS account, but I do have a GDID at the registry
location you cite, above.
Even if you delete the LID registry entry, Windows recreates it on a
reboot. A fresh install would generate a new GDID, except Microsoft
still has the old one, and now a new one, and they'll track you through
each GDID you generate. They don't need an MS account, but can track
whatever GDID you have by their services reporting your GDID for many
features users do want, like updates, especially security updates.
The GDID isn't just used with an MS account for sync purposes. It is
also used for updating, OneDrive, license control, and many other uses.
The regeneration of the GDID means MS services are creating it. You
can't get rid of GDID unless you switch to Linux.
Using a local/offline Windows account does not eliminate the creation,
use, and reporting of your GDID to Microsoft.
I use a local Windows account.
As an experiment, I changed the registry permissions for IdentityCRL so that only "Read" was enabled for all of the "Group or user names".
I deleted all the subkeys of IdentityCRL.
After rebooting, "MigrationDone", with a value of 1, was the only contents of the key.
Allan Higdon <allanh@vivaldi.net> wrote:
On Thu, 30 Jul 2026 22:44:13 -0500, VanguardLH <V@nguard.lh> wrote:
Boris <Boris@invalid.invalid> wrote:
Yep. I don't have a MS account, but I do have a GDID at the registry
location you cite, above.
Even if you delete the LID registry entry, Windows recreates it on a
reboot. A fresh install would generate a new GDID, except Microsoft
still has the old one, and now a new one, and they'll track you through
each GDID you generate. They don't need an MS account, but can track
whatever GDID you have by their services reporting your GDID for many
features users do want, like updates, especially security updates.
The GDID isn't just used with an MS account for sync purposes. It is
also used for updating, OneDrive, license control, and many other uses.
The regeneration of the GDID means MS services are creating it. You
can't get rid of GDID unless you switch to Linux.
Using a local/offline Windows account does not eliminate the creation,
use, and reporting of your GDID to Microsoft.
I use a local Windows account.
As an experiment, I changed the registry permissions for IdentityCRL so that only "Read" was enabled for all of the "Group or user names".
I deleted all the subkeys of IdentityCRL.
After rebooting, "MigrationDone", with a value of 1, was the only contents of the key.
Changing registry permissions is tricky. You may have change (removed)
write permissions for user accounts, but not for system accounts. Which security groups or for which usernames (accounts) did you change
permissions, and on which registry key, and what permissions were
removed? I might edit (but I won't due to nasty consequences) the write permission for the Administrators security group (of which Administrator
and my Windows account as an admin account are included), but touching permissions for the system accounts is very dangerous assuming you are
even allowed to change permissions on system accounts.
After the reboot, did your computer reconnect to the Internet?
As a further test, after deleting the LID subkey and rebooting, did you:
- Check for updates.
- Run the MS Store app.
- If using OneDrive, when did it last sync?
- If using any MS app, have you tried running it yet?
What is the startup state of the wlidsvc service (Microsoft Account
Sign-in Assistant)? At the time I checked on my Win10 22H2 host, it is configured for Start-up Type = Manual (meaning something else has to
call or trigger it) with Status = Running. If not needed, it may
eventually stop, but something else may eventually call it.
https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-accounts
"If the MSA service is disabled, Windows Update will no longer offer
feature updates to devices running Windows 10 1709 or higher."
The GDID is dependent on hardware identifiers, like you changed
hardware, so MS services will revalidate your license. Do you run a registered copy of Windows, or do you run an unregistered version while either overcoming or ignoring the artifacts of doing so, like you got
rid of the watermark on the desktop?
There are multiple IdentityCRL registry keys. One for each Windows
account. For which one(s) did you modify their write attribute? The
one under HKCU is just for your Windows account, but other accounts,
like the .DEFAULT account, also have GDIDs. See:
https://github.com/gd03gd031/Windows-GDID-Changer#what-is-gdid-and-how-is-it-generated
"Changing GDID requires forcing Windows to perform device registration again."
You need to be connected to the Internet and reach MS servers for [re]registration.
You can use Powershell to show your Windows account's GDID:
$lid=(Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties').LID "g:$([Convert]::ToUInt64($lid,16))"
That shows only the LID registry data item under whichever Windows
account you are currently logged into. When I checked my setup:
HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties
LID = 00184002C90B0C0F
HKEY_USERS\S-1-5-21-2131505889-2184669246-1466091326-1001\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties
LID = 00184002C90AF37D
HKEY_USERS\S-1-5-18\Software\Microsoft\IdentityCRL\ExtendedProperties
LID = 00184002C90B0C0F
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties
LID = 00188001C6C4E462
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties
LID = 00180003CA85DB6F
Notice the LID value for the GDID string is not the same across all
Windows accounts.
The HKU key with the longest SID (Security Identifier) is for my Windows account. The short SIDs (ending in 18, 19, and 20) are for well-known (system) Windows accounts: 18 = System/LocalSystem account, 19 = NT
Authority (LocalService), and 20 = NetworkService. There is also the .DEFAULT SID for the template Default account used when creating new accounts. See more about SIDs at:
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
| Sysop: | Jacob Catayoc |
|---|---|
| Location: | Pasay City, Metro Manila, Philippines |
| Users: | 4 |
| Nodes: | 4 (0 / 4) |
| Uptime: | 496008:15:25 |
| Calls: | 178 |
| Files: | 605 |
| D/L today: |
7 files (18,398K bytes) |
| Messages: | 70,118 |