What is the Windows Global Device Identifier (GDID) and how does it enable persistent device tracking even across VPN co

What is the Windows Global Device Identifier (GDID)?

Think of the GDID as a permanent ID card for your Windows computer. Microsoft officially describes it as “a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device … across certain Microsoft services and scenarios” [9][51]. It’s a 64‑bit number, not to be confused with the more familiar 128‑bit GUID [11].

Key properties of the GDID:

• Automatically assigned – Microsoft gives your PC a GDID when you install Windows or sign in with a Microsoft account [6][23][52]. It has been present since the initial release of Windows 10 in 2015 [12].
• Exists even without a Microsoft account – a GDID can be issued to a device that has never signed in to a Microsoft account [15][57].
• Permanent (mostly) – the identifier survives Windows updates, but a full Windows reinstall creates a brand‑new GDID [3].
• Hidden and locked – users cannot view or change their GDID through normal Windows settings [24][47], and it cannot be disabled [48].
• Stored everywhere – the GDID lives in the local registry and on Microsoft’s servers [24][34].

Behind the scenes, Windows services generate the GDID (the wlidsvc service requests a Device PUID from Microsoft’s servers, and the Connected Devices Platform registers it) [37]. Services like Delivery Optimization then quietly report the GDID back to Microsoft, often along with IP addresses and timestamps [10][37].

How does the GDID track you even when you use a VPN?

A device fingerprint, not a network address

A VPN hides your real IP address by routing your traffic through a different server. However, the GDID is a device‑level identifier and does not change when your IP changes. As one analysis put it: “A GDID doesn’t care which VPN you use, only that it’s still the same Windows installation” [20][53]. Even if your IP bounces from country to country, the GDID stays the same – it “doesn’t budge” [32].

Because Microsoft’s telemetry records the GDID together with every public IP address and a timestamp [5][8][49], the company can later link all those different IP addresses back to the same physical device. Law enforcement, with a court order, can ask Microsoft to disclose which GDID was using a particular IP at a particular time [50]. Investigators can then match that GDID against other data they already have, revealing the true owner behind the VPN [8][50].

How the FBI used the GDID to catch a hacker

The most publicised example involved the Scattered Spider hacking group. The FBI traced the suspect, Peter Stokes, across four countries over roughly eight months, even though he used VPNs and proxy servers [22][25][39][44].

Microsoft’s telemetry showed the same GDID:

• Visiting the ngrok.com/signup page while a VPN was active – right at the moment an attacker account was created [14][41]
• Accessing a victim retailer’s website through a VPN proxy [41]
• Linked to multiple other activities tied to the same intrusion [5]

Despite the suspect constantly switching exit nodes, the persistent GDID gave investigators a single, stable identity to follow [40][43]. The identifier “don’t rotate the way VPN exit nodes do” [7][54].

Why VPN providers are worried

Recognising that GDID defeats the anonymity VPNs aim to provide, at least one VPN company has created an experimental script to remove the GDID from Windows (although it may break some functionality) [16][30]. This reaction underscores how effective GDID is at piercing the VPN veil.

In short, the GDID enables persistent device tracking across VPNs because it is a hardware‑independent, OS‑level identifier that never changes, is silently reported to Microsoft with network information, and can be used to link all of a device’s online activity – masked or not – to a single installation [4][13][20][32].