--- title: Deletes all instances of Microsoft's GDID and prevents... description: degdid is a PowerShell-based tool and research repository targeting Microsoft's Global Device Identifier (GDID), a server-assigned 64-bit machine identifier... canonical: https://daily.dev/posts/deletes-all-instances-of-microsoft-s-gdid-and-prevents-minting-of-new-ones-67mqxuumh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Deletes all instances of Microsoft's GDID and prevents minting of new ones | daily.dev og:description: degdid is a PowerShell-based tool and research repository targeting Microsoft's Global Device Identifier (GDID), a server-assigned 64-bit machine identifier... og:url: https://daily.dev/posts/deletes-all-instances-of-microsoft-s-gdid-and-prevents-minting-of-new-ones-67mqxuumh og:image: https://api.daily.dev/og/posts/67MqxuUmH.png og:image:alt: Deletes all instances of Microsoft's GDID and prevents minting of new ones og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Deletes all instances of Microsoft's GDID and prevents minting of new ones **[Hacker News](https://daily.dev/sources/hn)** · 5 min read · 0 upvotes · 0 comments ## Summary degdid is a PowerShell-based tool and research repository targeting Microsoft's Global Device Identifier (GDID), a server-assigned 64-bit machine identifier that Windows can acquire even on local accounts. The tool removes existing GDID state from known local stores and blocks the DeviceAdd network path to prevent new GDIDs from being minted. It supports Windows 10 22H2 and Windows 11 builds, with full lab validation on Windows 11 25H2/build 26200. The Protect operation applies hosts-file and firewall blocks, clears GDID copies from registry and credential stores, and verifies the network gate before declaring success. Lab evidence includes over 33 hours of protected runtime, observed remint/reprotect cycles, and MSA-connected field runs. Known compatibility impacts include broken MSA sign-in, Store/Xbox auth, OneDrive, and Phone Link. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Microsoft's GDID and can it be assigned to a local Windows account? GDID (Global Device Identifier) is a server-assigned 64-bit Device PUID that Windows mints through Microsoft's DeviceAdd infrastructure. Having only a local Windows account does not prevent the machine-level mint — the identifier is assigned at the device level, not the user account level, and is retained across several local identity stores including registry, credential stores, and service paths. _Developers and researchers tracking Windows privacy changes follow developments like this on daily.dev._ ### What Windows builds does the degdid GDID removal tool support? degdid supports Windows 10 22H2 (build 19045) and Windows 11 build 22000 or newer. Windows 11 25H2 (build 26200) is the fully lab-validated line. Other accepted builds produce warnings rather than errors. Managed systems with domain, Entra, MDM, or workplace enrollment are refused outright rather than given speculative compatibility. _Those hardening personal Windows machines against telemetry track tools like this on daily.dev._ ### What services does blocking GDID minting break on Windows? Blocking the DeviceAdd path via hosts-file and firewall rules is expected to break or degrade MSA sign-in, Microsoft Store and Xbox authentication, OneDrive MSA sign-in, Phone Link, and CDP graph features. Core desktop access, Windows Update scans, and Defender updates were observed working in lab conditions, though a pending cumulative or feature update remains unvalidated. _Anyone weighing the privacy trade-offs of Windows identity blocking can find related research on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 41 comments across hackernews (as of 2026-08-09). **TL;DR:** The discussion is dominated by criticism of the tool's LLM-generated writing style rather than its technical merits, with secondary debate about whether removing the GDID is even the right approach versus spoofing or randomizing it. **Sentiment:** 15% positive · 35% mixed · 50% skeptical **The case for** - Court documents confirm the GDID was used to identify a real suspect, validating that it is a genuine tracking identifier worth addressing. - Blocking GDID at the network/firewall level (e.g., via a Pi-hole or upstream Linux firewall VM) is a meaningful privacy countermeasure. **The pushback** - The documentation reads as unedited LLM output ('claudish'), making it very hard to parse and undermining trust in the project. - Removing the GDID entirely may stand out more than spoofing or randomizing it, potentially making the host more identifiable rather than less. - Windows reportedly has a hardcoded list of Microsoft domains that bypass the hosts file, which the tool does not appear to address. - Breaking MSA sign-in, Store/Xbox auth, OneDrive, and Phone Link is a steep compatibility cost that limits practical adoption. - Browser fingerprinting and the hundreds of other telemetry calls Windows makes mean removing the GDID alone provides limited privacy benefit. **By community** - hackernews (skeptical): Commenters are largely preoccupied with mocking the LLM-generated prose style, while those engaging with the substance debate whether deletion is the right strategy versus spoofing, and whether the tool's hosts-file approach is even effective given Windows' domain bypass list. **Hottest debate:** Whether deleting the GDID is more effective than spoofing or randomizing it, given that absence may itself be a distinguishing signal. **Open questions** - Does Windows' hardcoded domain bypass list render the hosts-file block ineffective, and if so, is there a reliable countermeasure short of an upstream firewall? - Would spoofing a shared or randomly-rotated GDID provide better privacy than outright removal? - Is Microsoft's retention of GDID-to-IP associations compliant with GDPR, and has any regulator investigated? **Highlights** > "The mutation path", "the fully lab-validated line. Other accepted builds warn.", "Status can still inspect", "command, verdict, exit code", "device-identity rehydrate sources", "the network gate", "real-shaped PUID"? WTF. That was extremely difficult to read. I'm assuming it's LLMese (I've had less trouble with reading the writing of ESL'ers), but one of the strangest dialects of it I've ever seen. It has the flavour of article-spun SEO spam and those shady fake research papers with "tortured phrases". What causes this obfuscated writing style? > — [userbinator on hackernews · 6 comments](https://news.ycombinator.com/item?id=49235933) > Wouldn't it make more sense to instead use the same GDID on thousands of hosts? Or a random GDID on each read? No GDID sounds like it sticks out a lot more. > — [hypfer on hackernews · 4 comments](https://news.ycombinator.com/item?id=49235556) > You might've missed this recent story where the FBI was able to identify an alleged teenage member of the Scattered Spider hacking group using the Microsoft GDID, and made an arrest: https://news.ycombinator.com/item?id=48815196 https://news.ycombinator.com/item?id=48920338 > — [future10se on hackernews](https://news.ycombinator.com/item?id=49235862) > Windows has a hardcoded list of Microsoft domains that entirely bypass the hosts file. I see nothing about this, so I would assume there is no countermeasure here. Curiously, this approach appears to have been tested as working anyway. > — [LoganDark on hackernews · 3 comments](https://news.ycombinator.com/item?id=49235822) > It's missing a couple of wrinkles, surfaces, belt-and-suspenders, belt-and-braces, knobs, no-ops, "things that narrate", bookkeeping, stranded sessions, "the gate leads the arrangement", shit-gated, "to be wired after we've dealt with the parked features", "that's not the whole story", "the interface wants classes", slots and "whatever-backed interfaces". All of this is enhanced claude-era vocabulary minted at the pool-of-efficiency, built as a de-facto evolution of legacy-style language. Humans and their comment postambles, amirite? (Here's a literal quote from a claude session: "After the f-war, the evidence itself stops lying." I don't understand why companies are not focusing more on making these highly intelligent models speak a decent language. Maybe they are, and they're failing. But the last few months have made it pretty difficult to engage with these highly intelligent assistants.) > — [jorl17 on hackernews · 1 comments](https://news.ycombinator.com/item?id=49237055) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49235242) · 46 points · 41 comments ## Similar posts on daily.dev - [Cut the tracker that follows you even under VPN](https://daily.dev/posts/cut-the-tracker-that-follows-you-even-under-vpn-2zdmoafyl) · Hacker News · 0 upvotes · 0 comments - [Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing](https://daily.dev/posts/microsoft-confirms-windows-gdid-device-identifier-that-cannot-be-disabled-documented-in-fbi-case-fi-41de1nn3d) · Hacker News · 0 upvotes · 0 comments - [Windows Device ID in Hacking Case Raises Questions About Enterprise Telemetry](https://daily.dev/posts/windows-device-id-in-hacking-case-raises-questions-about-enterprise-telemetry-599kucv0b) · Security Boulevard · 0 upvotes · 0 comments - [Windows is watching: Anti-piracy tool fingers Scattered Spider suspect](https://daily.dev/posts/windows-is-watching-anti-piracy-tool-fingers-scattered-spider-suspect-llvutwvx7) · The Register · 0 upvotes · 0 comments - [Dev Machine Guard Now Supports Windows](https://daily.dev/posts/dev-machine-guard-now-supports-windows-zeykgixzl) · StepSecurity · 0 upvotes · 0 comments --- Tags: [#windows](https://daily.dev/tags/windows), [#privacy](https://daily.dev/tags/privacy), [#powershell](https://daily.dev/tags/powershell) [View this post on daily.dev](https://daily.dev/posts/deletes-all-instances-of-microsoft-s-gdid-and-prevents-minting-of-new-ones-67mqxuumh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Deletes all instances of Microsoft's GDID and prevents minting of new ones","url":"https://daily.dev/posts/deletes-all-instances-of-microsoft-s-gdid-and-prevents-minting-of-new-ones-67mqxuumh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/deletes-all-instances-of-microsoft-s-gdid-and-prevents-minting-of-new-ones-67mqxuumh"},"datePublished":"2026-08-09T21:26:22.384Z","dateModified":"2026-08-09T23:42:37.047Z","description":"degdid is a PowerShell-based tool and research repository targeting Microsoft's Global Device Identifier (GDID), a server-assigned 64-bit machine identifier...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/008be073c50bd743ac9139f6797561af?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/008be073c50bd743ac9139f6797561af?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/deletes-all-instances-of-microsoft-s-gdid-and-prevents-minting-of-new-ones-67mqxuumh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"windows,privacy,powershell","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Deletes all instances of Microsoft's GDID and prevents minting of new ones"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/deletes-all-instances-of-microsoft-s-gdid-and-prevents-minting-of-new-ones-67mqxuumh#faq","mainEntity":[{"@type":"Question","name":"What is Microsoft's GDID and can it be assigned to a local Windows account?","acceptedAnswer":{"@type":"Answer","text":"GDID (Global Device Identifier) is a server-assigned 64-bit Device PUID that Windows mints through Microsoft's DeviceAdd infrastructure. Having only a local Windows account does not prevent the machine-level mint — the identifier is assigned at the device level, not the user account level, and is retained across several local identity stores including registry, credential stores, and service paths. Developers and researchers tracking Windows privacy changes follow developments like this on daily.dev."}},{"@type":"Question","name":"What Windows builds does the degdid GDID removal tool support?","acceptedAnswer":{"@type":"Answer","text":"degdid supports Windows 10 22H2 (build 19045) and Windows 11 build 22000 or newer. Windows 11 25H2 (build 26200) is the fully lab-validated line. Other accepted builds produce warnings rather than errors. Managed systems with domain, Entra, MDM, or workplace enrollment are refused outright rather than given speculative compatibility. Those hardening personal Windows machines against telemetry track tools like this on daily.dev."}},{"@type":"Question","name":"What services does blocking GDID minting break on Windows?","acceptedAnswer":{"@type":"Answer","text":"Blocking the DeviceAdd path via hosts-file and firewall rules is expected to break or degrade MSA sign-in, Microsoft Store and Xbox authentication, OneDrive MSA sign-in, Phone Link, and CDP graph features. Core desktop access, Windows Update scans, and Defender updates were observed working in lab conditions, though a pending cumulative or feature update remains unvalidated. Anyone weighing the privacy trade-offs of Windows identity blocking can find related research on daily.dev."}}]} ```