Microsoft's Secret Tracking Feature in Windows! FBI Identifies Hacker, Sparks Privacy Concerns

A recent legal case in the United States has revealed a tracking mechanism called Global Device Identifier (GDID) in Microsoft's Windows. This feature assigns a long-term identification code to each Windows device, affecting approximately 1.6 billion Windows PCs worldwide.

GDID first gained external attention due to a major hacking case in the United States. Peter Stokes, a 19-year-old with dual American and Irish citizenship, was arrested at Helsinki Airport in Finland in April and extradited to the United States in June to face trial.

The prosecution alleges that Stokes was involved with the hacker group Scattered Spider, which is believed to have been involved in over 100 cyber intrusion incidents. Among these, in May 2025, they attacked a luxury jewelry retailer, impersonating employees to call the customer service center and using social engineering to reset account credentials and multi-factor authentication (MFA), stealing at least 77GB of data and extorting approximately $8 million in cryptocurrency.

According to the indictment, Stokes used proxy servers and multiple aliases to conceal his identity, believing he was difficult to trace. However, the FBI obtained the GDID of his device from Microsoft and discovered that the same device identifier had connected to the ngrok registration page when creating the attacker's account, and a few hours later, the same proxy server was used to access the victim company's system.

Investigators further discovered that the same GDID appeared in IP records from Tallinn, Estonia, New York, USA, and Thailand, spanning several months. These records matched Stokes' travel data and social media posts, ultimately forming a complete digital evidence chain.

Notably, this case is not only the first time GDID has been used as a key tracking basis in a public legal case, but also the first time Microsoft has confirmed the existence of this mechanism, bringing this previously little-known Windows device identification technology into the public eye.

According to Microsoft's court documents in the United States v. Peter Stokes case, GDID is a "long-term, device-level identifier used to uniquely identify Windows operating system installation instances."

GDID is a 64-bit numeric value, typically starting with "g:" followed by a long string of numbers. This identifier is not created by the user's device but is generated by Microsoft's servers and returned, then stored in the local registry. Whether it is a physical computer or a virtual machine, as long as Windows is installed, the system will obtain a unique GDID.

According to the documents, when a user sets up a Microsoft account in Windows, the system's Passport authentication service will actively communicate with Microsoft's servers. After the server returns the GDID, the system will write it to the LID key value under the path HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties in the Windows registry.

Next, Windows' Connected Devices Platform will register this identifier with Microsoft's cross-device identity management system, Device Directory Service, completing the identity binding between the local device and the cloud account.

Notably, the court documents point out that GDID will not change with general Windows updates, and most system setting adjustments will not affect its identifier. Although reinstalling Windows will generate a new GDID, the old GDID and its related records on Microsoft's servers will still be retained and will not be cleared with the reinstallation.

In other words, the GDID data preserved by Microsoft is cumulative. Each interaction between the device and the service leaves a record that may continue to be included in the device's historical data, forming a long-term identification and tracking record.

GDID is everywhere

According to the analysis of independent researchers who performed reverse engineering on the mechanism, the use of GDID is not limited to device recognition but has been deeply integrated into multiple core services and functions of Windows.

At the system level, GDID will be associated with Windows activation information. Microsoft Store purchase records, application license verification processes, and other flows will also carry this device identifier. In other words, the user's transaction and license information in Microsoft Store may be linked to a specific device identity.

In cross-device functions, Windows' "Phone Link" will use GDID to establish a pairing relationship between the phone and the computer, and cross-device clipboard synchronization will also use this identification mechanism to confirm device identity. For example, when a user copies text on their phone and pastes it into a Windows PC, GDID will help complete device recognition and pairing in the background.

Additionally, diagnostic data is also related to GDID. Research indicates that general diagnostic data for Windows will include this identifier; if the user enables Microsoft Edge's enhanced diagnostic function, browsing history may also be associated with GDID.

This feature also became an important basis for the investigation in the Peter Stokes case. Investigators were able to link Edge browsing history to a specific device through GDID. Even if the suspect hid their source IP through proxy servers, they could not escape the device identification record established by GDID, allowing the relevant digital evidence to be linked into a complete investigation path.

What users can do

General users can also query their computer's GDID. By executing the following command in PowerShell, you can read the identifier stored in the Windows registry: $hex = (Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties').LID

Then execute: g:$([Convert]::ToUInt64($hex,16)) The system will display the GDID corresponding to the device. The entire query process does not require system administrator privileges, and any user logged into Windows can directly view it.

However, currently, users can only view their own GDID, and there are no known methods to prevent Windows from creating this identifier or to delete the historical records already stored on Microsoft's servers. In other words, even if you reinstall the operating system or change some system settings, you cannot clear the GDID-related data that Microsoft has already established.

The security research team Zerotrace Lab once attempted to modify the GDID on the device through custom keys and published the complete experimental process, hoping to verify whether this device identifier could be tampered with or forged.

The test results showed that although users can modify the GDID value in the local Windows registry, if the local data and the identification information saved on Microsoft's server are inconsistent, some Windows functions will become abnormal. Researchers therefore speculated that GDID does not rely solely on local data but adopts a mechanism of local and cloud synchronization verification.

Currently, there is no evidence that Microsoft provides GDID to advertisers or other third parties. Microsoft's official documents also state that this identifier is used only for internal services. However, law enforcement agencies can still obtain relevant data from Microsoft through court orders or subpoenas, and the Peter Stokes case is one such example.

However, many security experts believe that the real controversy is not GDID itself, but Microsoft's lack of sufficient disclosure about its existence and purpose.

Currently, most mainstream operating systems have some form of device identification or tracking mechanism, but they usually provide clearer notification or management methods. For example, Apple requires apps to obtain user authorization through the App Tracking Transparency (ATT) mechanism; Google allows Android users to reset the advertising identifier; as for Linux distributions, due to the adoption of the open-source model, the relevant data collection mechanisms can also be publicly reviewed by the community.

In contrast, Windows' public information about GDID is relatively limited.