Privacy service provider Windscribe has released an open-source PowerShell script named deGDID, designed to erase and block Microsoft's Global Device Identifier (GDID) on Windows 11 operating systems. The release addresses growing public concern over persistent local telemetry markers that remain tied to individual computer installations regardless of virtual private network usage or IP address modifications.

According to documentation released alongside the tool, GDID operates beneath the network layer where consumer privacy software typically functions. By removing cached local tokens and enforcing strict outbound firewall rules against Microsoft device registration endpoints, Windscribe aims to give users greater control over hardware-level telemetry, albeit with trade-offs regarding native cloud services.

Windscribe Releases deGDID Tool for Windows 11

The release of deGDID marks a direct response to public revelations surrounding how Microsoft operating systems maintain device identity across sessions. Windscribe engineered the tool as an experimental utility that interacts directly with local system repositories, registry keys, and network routing tables. Unlike conventional privacy toggles found within the Windows Settings menu, deGDID addresses lower-level identification mechanisms that lack user-facing opt-out mechanisms.

Because standard privacy software focuses primarily on network-level IP masking, persistent hardware-linked identifiers can continue to report telemetry data to vendor servers. Windscribe developed deGDID to close this gap by addressing local storage mechanisms directly on the host computer.

How the deGDID Script Clears Local Telemetry Identifiers

When executed with administrative privileges, the deGDID script performs a systematic scan of the local system to identify stored GDID tokens. It targets specific registry hives and local cache locations utilized by Windows identity management services. Once located, these cached values are permanently deleted from local storage.

Furthermore, the utility modifies access permissions on critical registry keys to prevent the operating system from re-writing the deleted identifier back to disk. The script also sanitizes local diagnostic logs to ensure that historical device keys are not retained in offline system traces.

Blocking Future GDID Generation Across Microsoft Services

Clearing existing local files represents only half of the remediation process, as Windows naturally attempts to request a replacement identifier upon contacting Microsoft authentication servers. To counter this, deGDID alters system configuration files and establishes targeted rules within the Windows Filtering Platform.

By editing the local host routing table and inserting specific firewall blockades, the script interrupts communication with Microsoft DeviceAdd endpoints. This network-level block prevents the operating system from minting a new server-issued identifier, effectively preserving the scrubbed state.

Understanding Windows 11 Hidden GDID Device Tracking

The Global Device Identifier is a 16-digit, server-issued alphanumeric token tied to a specific Windows installation. While Microsoft documents components like GlobalDeviceId in enterprise reporting tables for services such as Windows Update for Business and Delivery Optimization, its broader role in system identity management remained largely opaque to consumer audiences until recently.

Public scrutiny surrounding GDID intensified following a federal criminal court filing unsealed in July 2026. In the court documents, law enforcement agencies outlined how Microsoft provided server logs correlating a specific Windows GDID with external network activity, successfully linking disparate IP addresses to a single physical computer. The affidavit confirmed that the identifier remains fixed across system updates, changing only when an administrator completely reinstalls the operating system.

Data Collected by GDID Identifiers

Research indicates that GDID generation involves a combination of hardware telemetry signals and account-registration events sent to cloud endpoints. While it is not derived strictly from motherboard serial numbers, the identifier creates a durable link between a device installation and cloud infrastructure.

  • Installation State: Tracks system continuity across software patches and feature updates.
  • Network Associations: Connects changing IP addresses back to a singular, persistent machine identity.
  • Service Timestamps: Records the exact time and sequence when a specific device accesses integrated cloud services.
  • Hardware Signatures: Incorporates baseline system hardware metrics during the initial account handshake process.

Impact on Microsoft Apps and Account Authentication

Because GDID is deeply embedded within the core Windows identity framework, blocking its generation is not without consequence. Windscribe explicitly warns users that running deGDID can cause operational degradation across several native applications and authentication services.

Independent testing confirmed that severing the device registration path disrupts login functionality for the Microsoft Store, Xbox ecosystem, and Outlook client applications. Users may also experience issues with OneDrive synchronization, Windows Hello biometric logins tied to cloud accounts, and passkey authentication mechanisms.

Privacy Implications for Windows 11 Users

The emergence of deGDID highlights a growing debate surrounding user consent and device telemetry in modern operating systems. While tech providers utilize stable device identifiers to prevent fraud, manage licensing, and deliver localized updates, privacy advocates argue that persistent tracking mechanisms operating without explicit user controls infringe on personal autonomy.

Windscribe clarified that deGDID is an experimental tool targeted at advanced users who prioritize privacy over seamless cloud integration. The tool cannot remove historical records already retained on remote vendor servers prior to script execution. Nevertheless, its release presents Windows 11 users with a tangible mechanism to audit local telemetry markers and limit persistent hardware tracking on their systems.

As operating systems lean more heavily into cloud-connected architectures, utilities like deGDID underscore the delicate balance between seamless digital services and strict consumer data privacy.