Some good information on the Windows GDID tracking number, but of interest Apple has something similar. And if you turn off analytics, Apple is still sharing it. And for the win, Linux which does have a unique identifier, but it doesn’t share it with anyone, and you can reset it if you wish. It’s definitely time to move to open operating systems on all your devices that won’t be part of the surveillance state.
https://reclaimthenet.org/can-you-escape-the-device-identifiers
Every platform remembers you in its own language.
By Rick Findlay
Reclaim The Net reported this month on how the FBI caught an alleged member of the Scattered Spider hacking crew, and on the number that made it possible. A Global Device Identifier, or GDID, g:6755467234350028, named in a federal complaint, tied a Windows installation to an ngrok signup, then to a hotel in New York, then to the defendant, Stokes. He was behind a VPN throughout.
Readers came back with one question in a dozen forms. Does a virtual machine help? Does a Mac? Does Linux? Is this only Microsoft?
The public reaction has been mostly wrong in two directions. One widely shared version had Windows secretly hashing motherboard serial numbers since 2015. Another had the problem ending at the Apple Store. The errors are doing damage because people are taking steps that achieve nothing while skipping the ones that work.
What a GDID is
The viral version claimed a 128-bit value derived from hardware serials at install time. Reverse engineering published since the complaint was unsealed shows both halves of that are false. That work is thinner than the coverage suggests, amounting to one researcher’s teardown of the Windows identity stack and a second lab since testing the same claims. Most of what has been written elsewhere traces back to it.
The value in the court record is 64 bits. The complaint itself says that reinstalling Windows produces a new GDID, which rules out any derivation from fixed hardware. A number computed from your GPU serial would come back the same after a wipe. This one does not.
When Windows provisions your device against a Microsoft Account, a service called wlidsvc contacts login.live.com and receives a Device PUID, a Passport Unique ID, inside the server’s response. Windows does not compute this number. It asks for one and is handed one. The value lands in your own registry, in plain text, at HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties under a key named LID.
From there the Connected Devices Platform reads that number and registers it into Microsoft’s Device Directory Service, the identity graph that ties your machines together. The same background service runs Phone Link, cloud clipboard and Nearby Share. The number is written into the directory with a lowercase g: in front. Delivery Optimization reports the same value back to Microsoft. It appears in an Azure Monitor table called UCDOStatus, an enterprise reporting schema most consumers will never see, where a column named GlobalDeviceId is described as an identifier used by Microsoft internally. That one line is the only place Microsoft has ever named it in public documentation.
The number is issued to your machine by a server and joined to your account. That is why reinstalling does not help. You get a new number, and Microsoft rejoins it to the old one through the account, the activation history and OneDrive. A footnote in the complaint concedes that one user can hold several GDIDs.
One further correction to the early coverage, including this publication’s, comes with a caveat of its own. Switching to a local account may not prevent this. The researcher who took the identity stack apart first reported that no Microsoft Account meant no registration. He then revised that on a second-hand report that the identifier is issued anyway and said he could not confirm it. Nobody has yet published an observed anonymous registration. Until somebody does, treat a local account as reducing what the number is joined to rather than as proof that no number exists.
Finding your own
Open PowerShell and run this command.
(Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties').LIDThe command needs no administrator rights. It returns sixteen hex digits beginning 0018, the device class prefix. Your user account has a separate number in the 0003 class, stored elsewhere.
To see it in the form Microsoft’s servers use, run this.
$hex = (Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties').LID
"g:$([Convert]::ToUInt64($hex,16))"If that key comes back empty, the same value is stored under HKCU\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\ in a DeviceId entry.
Do not publish the result. Your device PUID identifies you as precisely as the one in the complaint identified Stokes. The only number of this kind that is safe to quote is the court’s because a judge already made it public.
Virtual machines are not a workaround
Does running Windows inside Parallels or VMware on a Mac avoid the problem?
It does not. Microsoft’s own definition, as quoted to the court, covers a physical device or a virtual machine explicitly. A Windows VM provisions itself the same way and receives its own identifier.
The identifier describes the Windows installation rather than the Mac hosting it. What else the guest can see of the host depends on what your hypervisor writes into the virtual firmware, which varies by product and configuration. And the VM shares the host’s network connection. The IP history logged against that identifier is your real IP history, and IP history is what did the work in the Stokes investigation. A virtual machine contains the number. It does nothing about the trail the number leaves.
What Apple does differently
Apple has equivalents. Anyone claiming otherwise is selling something.
There is a hardware UUID, a universally unique identifier generated per machine, which survives reinstallation because it describes the logic board rather than the operating system on it. On Apple Silicon Macs you will more often see this presented as a provisioning UDID, a unique device identifier. There is a DSID, a persistent number bound to your Apple ID that links your devices to your account across iCloud and the App Store. And there is the Identifier for Advertisers, or IDFA.
Three things are said to separate Apple from Microsoft here. Two of them hold.
The first is visibility. You can look at your Mac’s hardware UUID without special tools. Hold Option and click the Apple menu, and About This Mac becomes System Information, which opens on the Hardware Overview. From the terminal, run this.
ioreg -d2 -c IOPlatformExpertDevice | awk -F'"' '/IOPlatformUUID/{print $(NF-1)}'Windows offers nothing comparable for the GDID anywhere in its interface. It took a federal prosecution to show most Windows users the term.
The second is consent. Apple’s advertising identifier requires an App Tracking Transparency prompt, and it can be reset, though Apple moved the reset out of the privacy menu in iOS 14 and buried it under General. Android provides comparable controls, including deletion of the advertising ID. The GDID has no prompt and no switch.
The third is control, and it is thinner than Apple’s marketing implies. IDFA is the only Apple identifier you can reset. The hardware UUID is fixed. The DSID follows your Apple ID, and researchers have previously shown Apple’s own App Store and Music analytics transmitting that identifier even with analytics sharing switched off. The toggle governs less than its label promises.
Apple publishes transparency reports covering government requests. So does Microsoft, twice a year, though only as aggregate counts of legal demands. On this identifier specifically, Microsoft has published no policy on when it shares the data, no opt-out and no numbers.
Apple holds the same category of power over its users, with more visible controls around the edges of it. A Mac never signed into an Apple ID is far less exposed, and almost nobody runs one that way.
What Linux does differently
Linux has a persistent identifier too, at /etc/machine-id.
That value is generated locally, from a random source, during installation or first boot. It is never requested from a vendor, and no company receives a copy. On virtual machines and network-booted systems it can be seeded from the hypervisor or set on the kernel command line, but on an ordinary desktop install it comes from your own machine. The systemd documentation treats it as confidential and warns against exposing it on a network. Microsoft transmits the GDID to its own servers by default.
You can regenerate it whenever you like.
sudo rm /etc/machine-id
sudo rm /var/lib/dbus/machine-id
sudo systemd-machine-id-setup
sudo ln -s /etc/machine-id /var/lib/dbus/machine-idReboot and the machine has a new identity that nobody else was ever told about. Reboot promptly, though. The journal, D-Bus and anything using the machine ID as a client identifier will misbehave until you do, and on most distributions that last line is recreating a symlink that already existed. Ownership of the identifier stays with the person using the computer.
What can actually be reset
On Windows, the advertising ID can be turned off under Settings, Privacy and security, Recommendations and offers, or under General on older builds. The GDID cannot be reset. A clean reinstall mints a new one, and Microsoft can reconnect it through your account.
On iOS, Privacy and Security, Tracking switches off the prompt and hands apps a zeroed identifier; the reset itself is under General, Transfer or Reset iPhone. On macOS the equivalent controls are under Privacy and Security, Advertising. The hardware UUID never changes. The DSID changes only if you use a different Apple ID.
On Linux, the persistent identifiers can all be regenerated by the person sitting at the keyboard, including the machine ID and, on most distributions, randomized MAC addresses per network.
Reducing the damage on Windows
If you are staying on Windows, the following reduce what is collected and correlated. None of them delete the identifier, and anyone telling you otherwise has not read the research.
Use a local account rather than a Microsoft Account. This no longer prevents an identifier being assigned, but it removes the account linkage that made the Stokes correlation possible, which is the part that turns a number into a person.
Disable the Connected Devices Platform, meaning the CDPSvc and CDPUserSvc services, which register your installation into Microsoft’s device graph and keep it synchronized. Phone Link, cloud clipboard and Nearby Share will stop working. For most people that is an acceptable trade.
Set diagnostic data to the required minimum under Settings, Privacy and security, Diagnostics and feedback. Turn off Cloud Content Search under Privacy and security, Search permissions, so local searches stop reaching Bing.
Do not go looking for the Activity History switch. Microsoft removed the option to upload activity history in January 2024 and removed the settings page itself in Windows 11 24H2. There is nothing left there to turn off, and the local database it wrote to is still on your disk. Killing the Connected Devices Platform is what addresses that now.
Deleting the %LOCALAPPDATA%\ConnectedDevicesPlatform folder on its own accomplishes nothing. Researchers have confirmed the identifier returns from the identity store immediately.
There is a hard limit to all of this. Massgrave, the group behind the widely used Windows activation scripts, says preventing a GDID entirely breaks activation and Store applications. The identifier is welded to the licensing system by design.
For anyone whose safety depends on not being identified, meaning journalists protecting sources, organizers, people escaping abusive partners, no Windows configuration is the answer. A different operating system is, with Tor rather than a commercial VPN. A device identifier does not care which VPN you are behind. It only cares that the installation is the same one.
What should change
The fixes available to individuals are marginal by design, and the ones that would count are not technical.
Microsoft could document the identifier in language ordinary users can read, show it in the interface and explain when it is disclosed to third parties. It could publish transparency figures covering these disclosures, as it does for other categories of legal request. None of that would compromise a single security function.
European regulators have the clearest opening. The identifier is assigned with no consent screen, persists across sessions and updates and is transmitted to a vendor alongside city, country and internet provider data in the same reporting table. Whether that survives contact with data protection rules requiring informed consent has not been tested, and it should be.
Courts have a question of their own. The Supreme Court required a warrant for historical phone location data in Carpenter v. United States in 2018. Whether a device’s trailing IP history is that kind of record, or an ordinary business record available on a lower standard, has not been decided. Stokes, facing the evidence he faces, will not be the defendant who finds out.
Until one does, the number stays in your registry in cleartext.