Last updated: July 2026
Key Takeaways
- Every Windows installation tied to a Microsoft Account carries a Global Device Identifier (GDID) that persists through VPNs, proxies, and IP changes, and cannot be switched off without breaking Windows activation and Store apps.
- In a 2026 federal case, Microsoft records tied one GDID to specific web pages, timestamps, and VPN exit addresses, letting investigators follow a single laptop across four countries for roughly eight months.
- The VPN did not fail. The operating system reported around it. Settings changes reduce what Windows sends, but real control lives at the network layer and, ultimately, in which operating system you run.
In April 2026, a 19-year-old was stopped at Helsinki's airport while boarding a flight to Japan. By early July, an unsealed federal complaint in Chicago identified him as Peter Stokes, an alleged member of the Scattered Spider hacking group. He did what most privacy guides recommend: routed traffic through VPNs and proxies, rotated exit addresses, and kept his real IP out of server logs.
None of it mattered, because his laptop had a name he had never seen: g:6755467234350028. That number is a Global Device Identifier, or GDID, and Microsoft's servers had been recording where it went, and when, the entire time. The case is the clearest public demonstration yet of a principle this site keeps returning to: whoever controls the infrastructure controls the experience. A VPN can hide you from the network. It cannot hide you from your own operating system.
The Case That Exposed the GDID
According to the Department of Justice, Stokes faces conspiracy, computer intrusion, and fraud charges tied to a May 2025 breach of a luxury jewelry retailer, which ended in a ransom demand of roughly 8 million dollars in cryptocurrency. The retailer evicted the intruders and paid nothing, though it reports at least 2 million dollars in disruption and cleanup costs. These are allegations; the case has not gone to trial.
What makes the complaint significant for everyone else is the evidence trail. Per the filing, Microsoft's records show that the device with GDID g:6755467234350028 loaded the ngrok account signup page at the same minute an account later used in the intrusion was created through a VPN proxy. Three hours later, the same GDID reached the victim retailer's website through the same proxy. Investigators then matched the identifier's appearances against IP records from Snapchat, Facebook, Apple, and Ubisoft accounts across Estonia, New York, and Thailand, reconstructing about eight months of movement across four countries. Reporting on the affidavit notes that nearly every match paired the GDID with a Snapchat login within minutes.
Two honest caveats. The GDID was one thread in a larger body of evidence, including seized servers, provider records, and social media activity; it stitched the rest together rather than solving the case alone. And the system worked as designed against an accused criminal. The story is what the complaint reveals about the roughly 1.6 billion other Windows machines doing the same reporting.
What Is Microsoft's GDID?
The Global Device Identifier is a persistent, device-level ID that Microsoft assigns to uniquely identify a specific Windows installation across certain Microsoft services. It is created when Windows is set up with a Microsoft Account, it survives every Windows update, and there is no settings toggle that turns it off.
Before this case, Microsoft's entire public documentation of the GDID was a single sentence in an Azure Monitor reference table describing it as an identifier used internally. The federal complaint, and the technical analysis it triggered, filled in the mechanics. As documented by gHacks, the identifier is produced by a chain of Windows services: the Microsoft Account sign-in service (wlidsvc) requests a Device PUID from login.live.com, the Connected Devices Platform registers it into Microsoft's Device Directory Service, and Delivery Optimization reports the GDID back to Microsoft during update transfers. The value sits in the registry under HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties, formatted as a lowercase g followed by a decimal number.
Three properties matter for your threat model:
- It is assigned without consent. Apple's advertising identifier requires a tracking prompt and offers a visible reset. Android exposes similar controls. The GDID has neither a prompt nor a user-facing view.
- It cannot be disabled cleanly. Researchers, including the Massgrave activation project, note that blocking the identifier's assignment breaks Windows activation and Microsoft Store apps. It is load-bearing infrastructure, not an optional feature.
- Reinstalling only half-resets it. A clean reinstall generates a new GDID, but the moment you sign back into the same Microsoft Account, Microsoft can link the new identifier to the old one's history. The persistence effectively lives at the account level, not the disk.
Your VPN Did Not Fail. Your Operating System Did.
A VPN does exactly two things: it replaces your visible IP address with the exit server's address, and it encrypts your traffic so your ISP cannot read it. Both worked flawlessly in this case. The websites Stokes allegedly visited saw only proxy addresses.
What a VPN cannot do is control the software running above it. Windows background services keep transmitting to Microsoft from inside the tunnel, carrying the GDID and a timestamp, arriving from whatever exit IP the VPN is using. Microsoft's logs therefore contain the exact correlation an investigator needs: this machine, at this time, behind this VPN address. Match one session to a login on any account tied to a real identity and the chain unravels backward.
| What is exposed | Does a VPN protect it? | Does Windows telemetry report it? |
|---|---|---|
| Your real IP address, as seen by websites | Yes, replaced by the exit server's address | The exit address is logged next to the GDID, enabling correlation |
| Traffic contents, from your ISP's view | Yes, encrypted inside the tunnel | Telemetry rides the same tunnel straight to Microsoft |
| Your device's identity | No | Yes, the GDID persists across every session and exit IP |
| Specific pages visited, with timestamps | Hidden from your ISP and the sites themselves | The complaint shows exact URLs logged against the GDID |
Based on the mechanisms described in the federal complaint and subsequent technical reporting. Microsoft has not published a full specification of what GDID-linked telemetry contains.
None of this is an argument against VPNs. It is an argument against believing a VPN is a complete privacy solution while the operating system underneath it answers to someone else.
The Unanswered Question: How Does Microsoft Know the URLs?
The most consequential detail in the complaint is also its least explained. Microsoft's records did not merely show the GDID connecting to Microsoft servers. Per the filing, they showed the device accessing specific pages on third-party sites, including the exact ngrok signup URL, with timestamps. That means some Microsoft channel logs full web addresses and associates them with the device identifier.
The complaint does not name the collection channel, and this is where verified fact ends and inference begins. Security researchers have pointed to plausible candidates, including Defender SmartScreen's URL reputation checks and Edge browser telemetry, both of which transmit visited addresses to Microsoft by design. What no one outside Microsoft can currently answer is scope: whether such URL-level records exist for browsing generally or only in narrower scenarios, and how long they are retained. Researcher Costin Raiu has publicly asked how much equivalent capability exists on other platforms. Until Microsoft documents the pipeline, treat confident claims about exactly what is logged and retained as speculation, including from us. What is not speculation is that URL-level, device-linked records existed when a federal investigation asked for them.
What This Means If You Are Not a Hacker
It is tempting to file this under problems for criminals. That framing misses the structural point. The GDID exists on every Windows installation linked to a Microsoft Account, which Windows 11 pushes hard as the default. Nobody consented to it, nobody can view it through a normal interface, and nobody can turn it off. The records it generates are held by a third party and are reachable by subpoena, civil discovery, government request, or a future data breach, none of which require you to be suspected of anything today.
The account linkage is the part most people underestimate: a fresh install is tied back to your history the moment you sign in, so your device identity follows you across hardware refreshes and reinstalls for as long as you keep the account. That is not a fingerprint. That is a dossier index. Whether the entity holding it is trustworthy this year is a separate question from whether the architecture should exist at all, and on a long enough timeline, identifiers this durable always find new customers.
How to Actually Limit Windows Telemetry
Honest framing first: you can reduce what Windows reports, but you cannot make a Microsoft-Account-joined Windows machine anonymous to Microsoft. Every step below shrinks the data trail. None eliminates it.
1. Use a local account instead of a Microsoft Account
The GDID is provisioned against Microsoft Account sign-in, and the account is what welds new identifiers to old history. Running Windows on a local account is the single highest-leverage change, though Microsoft has made the option harder to reach in Windows 11 setup, and you give up Store purchases, OneDrive sync, and cross-device features. That trade is the point.
2. Turn off every optional telemetry toggle
Under Settings, Privacy and security: set Diagnostics and feedback to send only required diagnostic data, disable personalized ads and suggestion tracking under Recommendations and offers, turn off Cloud Content Search so local searches stop reaching Bing, and disable Activity History. These are real reductions in volume, and they are also the ceiling of what Microsoft lets you decline. The required telemetry channel, and the GDID itself, remain.
3. Block telemetry at the network layer you own
This is where control actually changes hands, because your router does not take orders from Redmond. A DNS filter such as Pi-hole, running on hardware you own, lets you see and block telemetry endpoints for every device in the house, not just one PC. Our Pi-hole setup guide walks through the full build, and pairing it with open-source router firmware adds firewall-level egress rules that DNS filtering alone cannot enforce.
Be honest about the limits. Windows hard-codes some endpoints by IP, essential telemetry shares infrastructure with Windows Update and Defender definitions, and aggressive blocklists can break updates you want. Network filtering is a reduction and monitoring tool, not a kill switch, and the query log alone is revealing: you will see exactly how chatty the machine is.
Check Price on Amazon: CanaKit Raspberry Pi 5 Kit
4. Keep the VPN, for what a VPN is actually for
Nothing in this case makes a VPN less useful at its real job: hiding your traffic from your ISP and your IP address from the sites you visit. It simply is not an operating-system control. Our standing recommendations are unchanged: Proton VPN or Mullvad, both chosen for transparent ownership and no-log track records. Proton's own analysis of this case reached the same conclusion: the weak layer was Windows.
5. The endpoint: an operating system that answers to you
Every step above negotiates with an OS whose telemetry you cannot fully decline. Linux ends the negotiation. Desktop distributions like Mint or Fedora have no equivalent mandatory, account-bound identifier, and researchers covering this case now recommend Linux outright for anyone whose safety depends on identifier persistence not existing, such as journalists and abuse survivors. Most readers will not switch this week, and dual-booting for sensitive work is a legitimate half-step. But the direction of travel is clear, and closed-source operating systems are moving toward more identity binding, not less.
Whoever Controls the OS Controls the Evidence
The pattern here is the one that runs through ISP rental gateways, cloud cameras, and smart TVs: equipment you do not control, generating records about you, held by someone else, available to whoever asks with sufficient authority. The fix is also the same at every layer. Own the hardware, run software that answers to you, and move the trust boundary to the edge of your network, a case we make in our guide to replacing your ISP's rental gateway. A VPN inside an untrusted OS is a locked door in a house where the landlord keeps a key. The GDID case did not create that problem. It just finally produced a court document proving it.
Frequently Asked Questions
What is a GDID in Windows?
A Global Device Identifier is a persistent ID Microsoft assigns to a specific Windows installation when it is set up with a Microsoft Account. It uniquely identifies that machine to Microsoft services, survives updates and VPN use, and appears in Microsoft's server-side logs alongside timestamps and the device's current IP address.
Can you disable the GDID in Windows 11?
No. There is no setting that disables it, and blocking its assignment breaks Windows activation and Microsoft Store apps because the identifier is woven into licensing and device authentication. You can reduce associated telemetry through privacy settings, but the identifier itself stays.
Does a VPN hide your activity from Microsoft?
No. A VPN hides your IP address from websites and your traffic from your ISP, but Windows telemetry travels through the VPN tunnel to Microsoft carrying the GDID, so Microsoft's logs still tie your device to each session, including the VPN exit address in use at the time.
Where is the GDID stored, and can I see mine?
It is stored in the Windows registry under HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties, as a value beginning with a lowercase g followed by a long number. Windows provides no settings page or app that displays it, which is itself part of the criticism: the identifier exists below every user-facing surface.
Does reinstalling Windows reset the GDID?
A clean reinstall generates a new GDID, but signing back into the same Microsoft Account lets Microsoft link the new identifier to the old one's history. Breaking the chain requires a fresh install, a local account or brand-new Microsoft identity, and acceptance that Microsoft's historical records of the old identifier persist.
Do Mac and Linux have an equivalent of the GDID?
Most commercial platforms maintain some persistent device identity for licensing and security, and Apple and Google bind devices to accounts too, though both expose more visible tracking controls than Windows does. Mainstream Linux distributions have no equivalent mandatory, account-bound identifier reporting to a central server, which is why researchers recommend Linux where identifier persistence is itself the threat.
