Your VPN Can’t Save You: How Microsoft’s GDID Tracks You Anyway

The Illusion of VPN Anonymity

When you turn on your VPN and see the connection status turn green, you might assume your online activity is completely shielded. But if you run Windows, your operating system is still tracking you, and a VPN cannot stop it.

Recently unsealed court documents detail a hidden Windows telemetry system that bypasses network-level protections. It is called Microsoft’s GDID, or Global Device Identifier. This persistent hardware tracker operates deep within the operating system, linking your physical machine to every IP address you use, even when your traffic routes through a secure VPN tunnel.

What is Microsoft’s GDID and How Does It Bypass Your VPN?

The Global Device Identifier is a server-assigned 64-bit device ID that Microsoft assigns to your Windows installation. It functions as a permanent digital fingerprint for your computer. While a VPN hides your real IP address from the websites you visit, it does not stop Windows from continuously sending telemetry data back to Microsoft’s servers.

Every time your computer pings Microsoft for updates, diagnostics, or background syncs, it transmits your active IP address alongside your unique GDID. Microsoft can easily correlate these data points. If you use a VPN to log into an anonymous forum while your Windows OS sends a telemetry ping at the exact same time, Microsoft’s logs connect your VPN session directly to your physical PC.

The Real-World Proof: How the FBI Caught a Hacker

This tracking mechanism came to light during the federal prosecution of Peter Stokes, an alleged member of the Scattered Spider hacking group. Despite Stokes using multiple VPNs, proxies, and remote desktops across Estonia, New York, and Thailand, investigators tracked him down through his Windows GDID.

Microsoft provided the FBI with telemetry logs showing that the exact same GDID connected to an ngrok signup page, various proxy servers, and Stokes’ personal social media accounts. His VPN hid his physical location from the web, but his operating system revealed his identity from the inside.

Why You Cannot Simply Delete Microsoft’s GDID

You might consider opening the Windows Registry to delete the offending keys, but Microsoft designed this tracking mechanism to be highly resilient.

• Automatic Re-minting: If you delete the GDID registry keys, Windows will query Microsoft’s servers and generate a new one the next time you go online.
• Linked Accounts: If you sign into a Microsoft Account, your new GDID will immediately link back to your existing profile.
• Hardware Fingerprinting: Windows generates hashes of your hardware components, allowing Microsoft to recognize your physical machine even after a clean operating system reinstallation.

There is no official off-switch in the Windows settings. Keeping your computer permanently offline is the only default way to ensure zero data is sent, which is impractical for most users who rely on proactive IT monitoring for small business to keep their systems running smoothly.

How to Silence the Tracker: The no-gdid Tool

While you cannot delete the identifier permanently without breaking core Windows features, you can stop your machine from reporting it. Security researchers have developed open-source tools specifically designed to silence this background communication.

One practical option is the no-gdid script on GitHub. Created by researcher Korben, this lightweight PowerShell script targets the specific services responsible for the telemetry.

How the no-gdid Script Blocks Microsoft’s GDID

Unlike experimental tools that wipe registry permissions and break Windows login services, the no-gdid utility focuses on blocking the communication channels themselves. It disables the Connected Devices Platform services and Delivery Optimization, and it modifies your local hosts file to block Microsoft’s reporting endpoints. This silences the telemetry reports without breaking your ability to log into your Microsoft Account.

To implement this on your machine, follow these steps:

1. Navigate to the official GitHub repository at https://github.com/Korben00/no-gdid.
2. Download the script and review the documentation to understand exactly which services will be silenced.
3. Run the PowerShell script with administrator privileges to apply the blocks.

It is important to be realistic about what these tools can do. As the developer notes, this script silences the reporting of your GDID, but it does not make you entirely anonymous. Relying on a consumer Windows installation for highly sensitive work remains a risk. If you want to secure your operating system further, check out [our guide on Windows privacy].