Microsoft Admits Windows 11 Has a GDID Tracker With No Off Switch
"AlwaysNever" writes:
A 19-year-old walked through Helsinki airport in April 2026 carrying two 2TB hard drives and a ticket to Japan. He couldn't make that flight. Finnish police stopped him on an Interpol Red Notice, and by July, US prosecutors had unsealed a federal complaint identifying him as Peter Stokes, an alleged member of the Scattered Spider hacking group, wanted over a May 2025 breach of a US luxury jewelry retailer that ended in an $8 million ransom demand.
[...] it was Microsoft that handed the FBI a way to trace Stokes' Windows PC across VPNs, proxy servers, and three countries. The tool is called a Global Device Identifier, or GDID , and outside a handful of enterprise documentation pages, most Windows users had never heard the term before this case made it public.
We went through the full 39-page complaint, cross checked it against independent reverse engineering of how Windows generates and transmits this identifier, and fact checked the technical claims since the story broke. Here is everything you need to know about GDID, how it caught Stokes, and what it means if you are one of the 1.6 billion people using Windows PCs.
The complaint quotes a Microsoft representative describing the GDID as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device, either a physical device (e.g., a mobile phone or laptop) or virtual machine, across certain Microsoft services and scenarios"
A Global Device ID (GDID) is a permanent, unique digital fingerprint that Microsoft automatically assigns to your computer when you install Windows or sign into a Microsoft account.
Microsoft uses it to manage software licensing and Windows Store apps, but because it links all your online activities on that computer back to a single identity, law enforcement can use it to track a device's true owner across the internet
It survives Windows updates. It does not survive a clean reinstall, and Microsoft's footnote in the complaint admits "one Microsoft user could have multiple GDIDs" over the life of a single account.
Read more of this story at SoylentNews.