GDID Windows: Neutralizing the Tracker That Bypasses Your VPN

Case Study: In April 2026, the FBI apprehended a suspected member of the "Scattered Spider" group. Despite utilizing a VPN with IP addresses spanning three different nations, the suspect was identified. The culprit wasn't a technical slip-up, but a persistent identifier embedded in Windows that Microsoft provides to authorities upon request: the GDID.

I previously explored this topic, but I wanted to see if it was actually possible to eliminate this tracker. Using a Windows 11 Pro Virtual Machine (VM) and some assistance from an LLM, I investigated the mechanics of this identifier.

What exactly is the GDID?

Contrary to popular belief, the GDID is not a motherboard serial number and not a hardware-based hash. Instead, it is a 64-bit PUID (Pseudo Unique Identifier).

Mathematically, this means there are $2^{64}$ possible unique IDs, ensuring that Microsoft can assign a distinct label to your account the moment you initiate a Windows session.

How the Tracking Flow Works

The identifier is stored in plain text within your registry, registered in a remote directory on Microsoft's end, and periodically transmitted by a background service.

Exposing Your Own Tracker

You can see the "label" attached to your back by running a simple command. Open PowerShell and execute the following:

$lid=(Get-ItemProperty 'HKCU:SOFTWARE\MicrosoftIdentityCRL\ExtendedProperties').LID 
"g:$([Convert]::ToUInt64($lid,16))"

Example output from my VM: g:6755487812206045

The "Quick Fixes" That Fail

Many users attempt to remove the tracker using common privacy tropes, but these are largely ineffective.

---

The Real Solution: Cutting the Connection

Since we cannot erase the ID from Microsoft's servers without deleting the account, the goal is to stop the transmission. We want to block the reporting mechanism without logging out of the Microsoft account, ensuring the PC remains functional.

The Strategy

1. Disable Reporting Services: Stop the services that register and upload machine data.
2. Host File Blacklisting: Redirect Microsoft's tracking endpoints to the void.
   • Crucial: We must avoid blocking login.live.com to maintain account access.

The DoSvc Hurdle

The service responsible for reporting the GDID, DoSvc, is stubborn. It cannot be disabled via the standard Service Manager. To kill it, you must modify the Registry, where administrative write access overrides the service manager's restrictions.

Implementation Guide

I have developed a set of tested scripts to automate this process.

⚠️ WARNING: Disable system services at your own risk. Always test these commands in a VM with a snapshot before applying them to a production machine.

Step-by-Step Execution

• 1. Clone the Repository

winget install --id Git.Git
git clone https://github.com/Korben00/no-gdid
cd no-gdid

• 2. Run the Read-Only Audit Check your current status and see which services are active:

powershell -ExecutionPolicy Bypass -File .\.auditGet-GDID-Audit.ps1

• 3. Preview the Changes Run the mitigation scripts without the -Apply flag to see what will happen:

powershell -ExecutionPolicy Bypass -File .\.mitigateDisable-GDID-Services.ps1
powershell -ExecutionPolicy Bypass -File .\.mitigateBlock-GDID-Endpoints.ps1

• 4. Apply the Block Execute the scripts with the -Apply flag to disable services and update the hosts file:

powershell -ExecutionPolicy Bypass -File .\.mitigateDisable-GDID-Services.ps1 -Apply
powershell -ExecutionPolicy Bypass -File .\.mitigateBlock-GDID-Endpoints.ps1 -Apply

How to Undo Everything

If you need to restore your system to its original state, run the revert script:

powershell -ExecutionPolicy Bypass -File .\.mitigateRevert-GDID.ps1

Final Result: The GDID remains readable on your local disk, but it is effectively silenced. The registration services are dead, the servers are unreachable, and your Microsoft account remains connected.