Windscribe has released an open-source tool called deGDID, designed to remove Microsoft’s Global Device Identifier (GDID) from Windows systems and stop the operating system from generating a new one afterward.
The free script targets a persistent identifier that operates below the network layer, meaning it isn’t affected by VPN use or changes to a device’s IP address.
The tool’s release follows a federal case in which the identifier reportedly helped the FBI locate an alleged hacker, drawing renewed attention to how the identifier functions.
How deGDID Works
deGDID runs through PowerShell and requires administrator privileges, with the script available for download directly from its GitHub repository. It includes four execution flags that control its behavior.
The flag performs a read-only check to determine whether a GDID is currently active on the system, while generates diagnostic logs with the identifier hidden, making it safer for users to share for troubleshooting purposes.
The core protection feature runs through the flag, which removes cached GDID keys from the Windows registry and modifies access control lists and registry permissions to stop Windows from generating new identifiers.
The script also adds a firewall rule targeting the internal DeviceAdd endpoint, preventing Microsoft’s identity services from recognizing the machine as registered. Changes can be reversed at any time using the flag, which restores default Windows settings.
Removing the Identifier Can Break Some Microsoft Services
In testing on a Windows 11 machine, Windscribe said the script performed as intended — the command initially detected several cached identifiers, which were then removed, and no new GDID appeared after a restart.
The testing also surfaced some trade-offs. Account verification through login.live.com stopped working across every browser tested, though login.microsoftonline.com continued functioning normally.
Some Microsoft applications returned connection errors once the identifier was disabled, while other software, including online games, kept working without issue.
Windscribe noted that deGDID is designed specifically to address device tracking rather than to protect against malware, and recommended that users continue running antivirus and endpoint protection tools separately.
Data Already Collected Remains With Microsoft
According to Windscribe, deGDID cannot remove GDID keys that have already been stored on Microsoft’s servers, meaning the company retains access to any data previously collected through the identifier.
The tool doesn’t erase information that has already reached Microsoft’s systems — it only prevents further tracking going forward.
The workaround also has limited compatibility: it won’t run on managed systems or domain-joined accounts, restricting its use to individual, unmanaged Windows machines.
Windows currently offers no built-in option to disable GDID, and the identifier stays tied to a device across different IP addresses regardless of VPN use.
Windscribe described deGDID as an ongoing research project and said it plans to keep developing the tool as more becomes known about how the identifier operates.
For users weighing the trade-off, the loss of certain Microsoft account functions is a real consideration — and since previously stored identifiers can’t be scrubbed from Microsoft’s servers, deGDID functions as a partial fix rather than a complete removal of existing tracking data.
