Microsoft Can Track Users via a Windows Device ID

a month ago

A teenager's arrest revealed Microsoft's use of a Global Device ID (GDID) to track Windows PCs and online activity, raising surveillance concerns.
Microsoft provided data linking the hacker to crimes via GDID, which persists across Windows updates but can be reset with a reinstall.
Experts worry GDID could enable widespread user tracking without cookies, prompting questions about similar identifiers on Apple devices.
Cybersecurity professionals suggest using Linux or VPNs for anonymity, as GDID may be tied to hardware or other identifiers.

Microsoft confirmed the existence of a Global Device Identifier (GDID) in a Windows installation linked to a Microsoft Account. It cannot be disabled without affecting activation and Microsoft Store apps.
The FBI used the GDID, which persists across VPNs and locations, to track a hacking suspect by correlating it with IP addresses and online activity across multiple services and countries.
Privacy researchers raise concerns about GDID due to lack of user consent, activation dependence, limited documentation, and potential for tracking across reinstalls when using the same Microsoft Account.

Microsoft's Global Device Identifier (GDID) is a persistent, unique digital fingerprint assigned to Windows installations when users sign in with a Microsoft Account, used for licensing and tracking across services.
The FBI used GDID to trace alleged hacker Peter Stokes by linking his Windows device's activity across VPNs and proxies to his online accounts, leading to his arrest at Helsinki airport in 2026.
Privacy concerns arise because GDID is assigned without user consent, lacks visible controls like on Apple or Android, and can persist across reinstalls via Microsoft Account linkages, raising surveillance questions.

Microsoft's Global Device ID (GDID) uniquely identifies Windows installations and survives reboots, updates, and removal.
The GDID was used in a US court case to identify a suspected member of the 'Scattered Spider' cyber gang despite VPN use.
The GDID is part of Windows telemetry sent to Microsoft servers, regardless of account type (Microsoft or local).

The GDID is a 64-bit PUID attached to a Microsoft account, stored on Microsoft's servers and rewritten to the registry on every login, persisting across VPNs and registry deletion.
Disabling telemetry does not block GDID; it is transmitted through DoSvc (Delivery Optimization) and Connected Devices Platform services.
Effective mitigation requires disabling specific services via registry (since DoSvc refuses normal disable) and blocking Microsoft endpoints via hosts file, while keeping login.live.com accessible.

Peter Stokes, a 19-year-old American-Estonian, was extradited from Finland to the U.S. on hacking charges linked to Scattered Spider.
An FBI affidavit ties him to an $8 million ransom demand via a Microsoft Global Device Identifier (GDID) that was unmasked despite VPN use.
Microsoft's cyber security researchers provided the GDID, which is used for diagnostics and abuse detection, after a court order based on ngrok service records.

Microsoft confirmed the existence of a Global Device Identifier (GDID) in a Windows installation linked to a Microsoft Account. It cannot be disabled without affecting activation and Microsoft Store apps.
The FBI used the GDID, which persists across VPNs and locations, to track a hacking suspect by correlating it with IP addresses and online activity across multiple services and countries.
Privacy researchers raise concerns about GDID due to lack of user consent, activation dependence, limited documentation, and potential for tracking across reinstalls when using the same Microsoft Account.

Microsoft's Global Device Identifier (GDID) is a persistent, unique digital fingerprint assigned to Windows installations when users sign in with a Microsoft Account, used for licensing and tracking across services.
The FBI used GDID to trace alleged hacker Peter Stokes by linking his Windows device's activity across VPNs and proxies to his online accounts, leading to his arrest at Helsinki airport in 2026.
Privacy concerns arise because GDID is assigned without user consent, lacks visible controls like on Apple or Android, and can persist across reinstalls via Microsoft Account linkages, raising surveillance questions.

Microsoft's Global Device ID (GDID) uniquely identifies Windows installations and survives reboots, updates, and removal.
The GDID was used in a US court case to identify a suspected member of the 'Scattered Spider' cyber gang despite VPN use.
The GDID is part of Windows telemetry sent to Microsoft servers, regardless of account type (Microsoft or local).

The GDID is a 64-bit PUID attached to a Microsoft account, stored on Microsoft's servers and rewritten to the registry on every login, persisting across VPNs and registry deletion.
Disabling telemetry does not block GDID; it is transmitted through DoSvc (Delivery Optimization) and Connected Devices Platform services.
Effective mitigation requires disabling specific services via registry (since DoSvc refuses normal disable) and blocking Microsoft endpoints via hosts file, while keeping login.live.com accessible.

Peter Stokes, a 19-year-old American-Estonian, was extradited from Finland to the U.S. on hacking charges linked to Scattered Spider.
An FBI affidavit ties him to an $8 million ransom demand via a Microsoft Global Device Identifier (GDID) that was unmasked despite VPN use.
Microsoft's cyber security researchers provided the GDID, which is used for diagnostics and abuse detection, after a court order based on ngrok service records.

Hasty Briefsbeta