Microsoft Confirms Windows Has a Global Device ID You Can’t Turn Off

Microsoft has confirmed that Windows has a previously unknown Global Device ID (GDID), a permanent, unique digital identifier assigned to Windows devices that can tie a user’s actions to their device. This came to light when an alleged member of a notorious hacking group was caught at an airport after Microsoft handed over his GDID to the authorities.

Microsoft describes the GDID in a published complaint (via Windows Latest) as “a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device, either a physical device (e.g., a mobile phone or laptop) or virtual machine, across certain Microsoft services and scenarios.”

So when you first set up Windows, or register a new Windows device, Microsoft ties that installation’s GDID to you. Anything that happens on that system can then be traced back to you, the individual.

You can’t adjust this in Windows settings.
Credit: Jon Martindale

Windows Latest discovered that this is generated at the server side, but is also stored locally. It can be found in the Windows registry under: “HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties.”

Although this number remains when you update Windows, it is updated if you reinstall Windows, assigning you a new GDID—though the original one may remain recorded as well.

In the case of the alleged hacker, he had used the same device for all his online activities, so even if his identity was hidden through other means, Microsoft was able to tie all those activities together. When Microsoft was able to spot patterns in behavior that matched those of a particular GDID it held on account, it was able to coordinate with authorities to tie the activities to the hacker in question, giving up his identity and leading to his eventual arrest and charges brought against him.

This has raised concerns among privacy advocates about Microsoft not providing an opt-out option for this level of tracking.