Meet deGDID: Windscribe's answer to the Windows tracker that VPNs cannot mask

Windscribe has released deGDID, a free tool that targets a hidden Windows identifier that VPNs cannot mask The identifier surfaced in a US court case where it helped trace a suspect's PC across VPNs and three countries Blocking the identifier can break Microsoft account features like Xbox, Outlook,

<![CDATA[ <article> <ul><li><strong>Windscribe has released deGDID, a free tool that targets a hidden Windows identifier that VPNs cannot mask</strong></li><li><strong>The identifier surfaced in a US court case where it helped trace a suspect's PC across VPNs and three countries</strong></li><li><strong>Blocking the identifier can break Microsoft account features like Xbox, Outlook, and the Store</strong></li></ul><p>Windscribe has built a new tool that takes aim at a form of Windows tracking that even the <a href="https://www.techradar.com/vpn/best-vpn">best VPN</a> cannot switch off.</p><p>The tool, <a href="https://windscribe.com/blog/windows-tracks-you-with-a-hidden-id-so-we-built-degdid-to-block-it/" target="_blank" rel="nofollow">called deGDID</a>, targets a little-known Microsoft identifier called the Global Device Identifier, or GDID. It is a server-assigned code tied to a Windows installation.</p><p>The GDID burst into public view in July after it appeared in a <a href="https://www.justice.gov/usao-ndil/media/1450651/dl?inline=" target="_blank" rel="nofollow">US federal complaint</a> against an alleged member of the Scattered Spider hacking group, where Microsoft gave investigators logs that correlated a Windows GDID with IP activity. Investigators traced the machine through VPN obfuscation across multiple countries over roughly eight months.</p><div class="product"><a data-dimension112="b324633e-8f4a-11f1-b272-276a715d9fb7" data-action="Deal Block" data-label="Windscribe: a feature-packed VPN" data-dimension48="Windscribe: a feature-packed VPN" href="https://windscribe.com/upgrade?promo=10YRBABY&pcpid=2026_420_email" target="_blank" rel="nofollow"><figure class="van-image-figure " ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:400px;"><p class="vanilla-image-block" style="padding-top:100.00%;"><img id="uDFVMwFvv5PRJATMXmEfqk" name="windscribe" caption="" alt="" src="https://cdn.mos.cms.futurecdn.net/uDFVMwFvv5PRJATMXmEfqk.jpg" mos="" align="middle" fullscreen="" width="400" height="400" attribution="" endorsement="" credit="" class=""></p></div></div></figure></a><p><strong>Windscribe: </strong><a href="https://windscribe.com/upgrade?promo=10YRBABY&pcpid=2026_420_email" target="_blank" rel="nofollow" data-dimension112="b324633e-8f4a-11f1-b272-276a715d9fb7" data-action="Deal Block" data-label="Windscribe: a feature-packed VPN" data-dimension48="Windscribe: a feature-packed VPN" data-dimension25="">a feature-packed VPN</a><br>Windscribe is fast, capable, and stacked with features. While the provider offers one of the <a href="https://www.techradar.com/vpn/best-free-vpn">best free VPNs</a> around, Windscribe Premium gives you access to the full server network across 115 locations and extra features, including threat protection and port forwarding. If you find that you're unhappy with the product, you can get your money back within a week of signing up. <a class="view-deal button" href="https://windscribe.com/upgrade?promo=10YRBABY&pcpid=2026_420_email" target="_blank" rel="nofollow" data-dimension112="b324633e-8f4a-11f1-b272-276a715d9fb7" data-action="Deal Block" data-label="Windscribe: a feature-packed VPN" data-dimension48="Windscribe: a feature-packed VPN" data-dimension25="">View Deal</a></p></div><h2 id="what-microsoft-s-gdid-is-and-why-a-vpn-won-t-help">What Microsoft's GDID is, and why a VPN won't help</h2><p>A Microsoft representative described the GDID in the complaint as a persistent, device-level identifier designed to uniquely identify an installation of Windows on a device.</p><p>It survives Windows updates but <a href="https://www.jaspreet.net/2026/07/18/3350/" target="_blank" rel="nofollow">not a clean reinstall</a>, which generates a fresh one. The privacy risk appears when that stable ID is tied to telemetry, Edge browsing data, Microsoft Store records, and <a href="https://www.techradar.com/pro/what-is-an-ip-address">IP addresses</a>, letting Microsoft reconnect the same machine across sessions and services.</p><p>A <a href="https://www.techradar.com/vpn/virtual-private-networks">virtual private network (VPN)</a> protects your traffic by masking your IP address and encrypting your data. The GDID sits outside that tunnel, at the layer where Windows talks to Microsoft's cloud, so it ties every session together no matter which IP the traffic came from.</p><p>Switching to a local Windows account doesn't fix it either. <a href="https://www.techradar.com/reviews/windscribe">Windscribe</a> found its test machine still created a GDID even as a local account, and after manually deleting the value from the registry, it reappeared after a reboot.</p><h2 id="how-windscribe-s-degdid-works-and-how-to-use-it">How Windscribe's deGDID works, and how to use it</h2><p>Windscribe's deGDID uses hosts file modifications and firewall rules to block the registration paths Windows uses to fetch a GDID, and wipes known local identity artifacts.</p><p>To run it, download the degdid.ps1 script <a href="https://github.com/yegors/deGDID" target="_blank" rel="nofollow">from GitHub</a> and run it in PowerShell with administrator rights. Use the -Status flag for a read-only check, or -Protect for the full block, verify, and wipe routine, with an -Unprotect option to reverse the changes. </p><p>The tool deliberately refuses to run on managed, domain-joined, or corporate machines.</p><div class="see-more see-more--clipped"><blockquote class="twitter-tweet hawk-ignore" data-lang="en"><p lang="en" dir="ltr">Windows is spying on you. By design.Microsoft's GDID is a unique, server-assigned identifier for your Windows install. A recent court filing showed Microsoft was able to connect a GDID to IP activity.VPNs don't help. Local accounts don't fix it.So we built deGDID.<a href="https://twitter.com/cantworkitout/status/2081846074415677714">July 27, 2026</a></p></blockquote><div class="see-more__filter"></div></div><p>This is not a clean opt-out. In hands-on testing, the script ran without errors, but then broke logins to Xbox, Outlook, and the Microsoft Store because the firewall rules also cut off the connectivity those services depend on. </p><p>Windscribe warns it may also affect OneDrive, passkeys, and Windows Hello, cannot guarantee it catches every GDID pathway, and does not erase records Microsoft already holds server-side.</p><p>For most people, this is just another reminder of what it means to be a Windows user, but if you want to inspect or reduce the identifier, deGDID is currently one of the only tools that tries. And if you want a more comprehensive solution, Windscribe suggests giving Linux a go.</p> </article> ]]>