What the GDID is
The FBI affidavit quotes a Microsoft representative. The representative describes the GDID as a persistent, device-level identifier. It is designed to uniquely identify an installation of Windows on a physical device or a virtual machine, across certain Microsoft services and scenarios. The phrase "certain Microsoft services and scenarios" is vague, and Microsoft hasn't spelled it out publicly.
Three properties matter:
- It identifies an installation, not a person or a motherboard. The GDID survives updates and reboots. It is regenerated when Windows is reinstalled.
- It is not one ID per person. The complaint also notes that one Microsoft user can have several GDIDs. That fits an identifier attached to installations: one user with a laptop, a desktop and a virtual machine would have several.
- It does not depend on account type. A GitHub researcher describes it as part of Windows telemetry sent to Microsoft's servers. According to that researcher, this happens whether Windows was set up with a Microsoft account or a local account. That is community reverse engineering, not Microsoft documentation. Treat it as a lead. The same write-up also says it is a Microsoft Account "Device PUID". Other outlets report that gHacks said the ID is generated when Windows is set up with a Microsoft Account. These accounts conflict, and Microsoft hasn't settled the question.
What the court filing shows
The case involves Peter Stokes, an alleged member of Scattered Spider. The complaint says investigators used Microsoft records to link his PC to online activity connected to a hack. The Justice Department announced the arrest in Finland and the extradition to the US on July 1, 2026. Stokes is presumed innocent unless proven guilty.
The filing gives one concrete example:
- The affidavit says Scattered Spider used the web tunneling tool ngrok, and a VPN service called Tzulo.
- Microsoft's GDID records showed the Windows device with that GDID accessing Tzulo servers assigned to the IP address ngrok identified.
- Per the complaint, the same GDID was tied to an ngrok signup page visit on May 12, 2025. Investigators compared the device's IP activity with records from other services and with travel evidence.
The GDID was one part of the evidence. The Register says the case relied "in part" on the GDID, among other telemetry records. Neither the complaint nor the DOJ announcement says the GDID alone identified the suspect.
What it does not prove
Some of the coverage overreaches, including the source guide this piece started from:
- The identifier is not itself a surveillance log. The guide claims the GDID "collects" data about usage, accounts and location. The complaint doesn't show that. It shows Microsoft records, keyed to a GDID, that included specific web activity and IP addresses. The identifier is the key. The records are what Microsoft holds under it.
- The complaint doesn't show that Windows logs all browsing or precise location for every user. It describes one set of records from one case.
- The VPN lesson is limited. One commentator in CSO's coverage notes that a device that phones home to Microsoft while on a proxy broadcasts its ID from that masked IP. That is a fair point about how a VPN works. A VPN hides your traffic from your ISP and websites. It does not stop Microsoft's own services from seeing the connection. It also doesn't prove a VPN can never protect you.
- The claim that Microsoft deliberately blocks disabling the GDID because it needs the data is unsupported. Microsoft hasn't said so. What is documented is that there is no user-facing switch. CSO's coverage quotes an analyst raising questions about data retention periods and the lack of a clear opt-out.
- The "spotlight in 2026" framing is only partly right. Windscribe's write-up says the GDID is not new but was recently pulled into public view by the complaint. That fits. The claim that users suddenly "realized" this at scale is a media narrative, not a measured fact.
Can you disable it?
Not through any documented Windows setting. gHacks reports that blocking it can affect Windows activation and Microsoft Store apps. Treat that as reported behavior, not something Microsoft has confirmed.
The source guide says registry edits and third-party tools might remove or block GDID information, and that this can interfere with Microsoft account sign-in. I could not verify any procedure, tool or affected Windows version for that claim, so I'm not giving registry paths or commands. Even if a local edit changed a stored value, that wouldn't show that Microsoft's server-side records were erased or that the identifier would stay gone. Some privacy vendors have released blocking tools. Windscribe, a VPN company, built one it calls deGDID. It is a commercial vendor's own claim. Don't run unvetted tools that touch system identity services on a PC you depend on.
What you can change
The settings that do exist control diagnostic data. They don't remove the GDID.
- Open Settings (Win + I).
- Choose Privacy & security.
- Select Diagnostics & feedback.
- Turn off Send optional diagnostic data.
Success looks like the toggle showing Off. Required diagnostic data is still sent.
What this changes, per Microsoft's documentation:
- Optional diagnostic data includes more detailed device and settings information, browser activity in Microsoft browsers, app activity, and enhanced error reporting. Turning it off removes those categories from what Windows sends.
- Microsoft's privacy documentation says common diagnostic headers include a device ID, a unique ID for that device and not the name you gave it. They also include the HTTP header information, including the IP address seen by the ingestion service. Required diagnostic data still sends a limited set of device and configuration data.
- The setting isn't documented as deleting or disabling a GDID. It also doesn't reach data held through other services or what other Microsoft apps send. Microsoft's guidance says Microsoft 365 apps and third-party software have their own diagnostic controls.
Also worth checking: Tailored experiences, which Microsoft says uses diagnostic data for personalized tips and ads. It is a separate toggle on the same page.
For IT administrators
Managed fleets get more controls than consumers:
- Group Policy has Allow diagnostic data under Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds. Microsoft also documents Limit dump collection and Limit diagnostic log collection there.
- Diagnostic data off is available only on Windows Server, Enterprise and Education editions. Microsoft warns that if you rely on Windows Update, Required diagnostic data is the minimum recommended setting. With diagnostic data off, update failure information isn't sent.
- Microsoft warns against blocking some endpoints. One is login.live.com, which is used for device authentication. Another is settings-win.data.microsoft.com, which is required to remotely configure diagnostic data. Blocking these is exactly how you break sign-in or telemetry configuration.
- Devices joined to a Microsoft Entra tenant can be enrolled in the Windows diagnostic data processor configuration. Microsoft then acts as processor and the organization as controller of that data. That is a compliance tool, not a GDID off switch.
None of these controls removes the GDID.
The practical takeaway
- A GDID ties records to a Windows installation. It is not a hardware serial number, and reinstalling Windows gives you a new one.
- The Stokes complaint shows Microsoft records keyed to a GDID being used alongside other evidence. It doesn't show that Windows logs everything you do.
- Turn off Send optional diagnostic data if you want to cut what Windows sends. Don't expect it to remove the identifier.
- Be skeptical of tools that promise to "disable" the GDID. They are unverified, and the reported side effects are activation and Store problems.
- The real open question is transparency. Microsoft hasn't publicly explained retention periods or which services use the GDID. Until it does, assume your installation can be correlated across Microsoft services.