Windscribe has released an open-source PowerShell script named deGDID that removes Microsoft's hidden Global Device Identifier from Windows and blocks the operating system from generating replacement identifiers.
The Global Device Identifier is a persistent device fingerprint that remains unchanged when users switch IP addresses and functions below the level of VPN tunnels. Recent reports indicate that this identifier helped the FBI locate a suspected hacker, prompting renewed privacy concerns among Windows users.
The script is distributed via GitHub and must be executed in PowerShell with administrator privileges. Available parameters include -Status to display detected identifiers, -Status -Redact to mask them in diagnostic logs, -Protect to delete stored keys and prevent new ones from being issued, and -Unprotect to restore default settings.
Simply deleting registry entries is insufficient because Windows silently recreates the identifiers after a reboot or contact with Microsoft servers. Therefore deGDID alters registry access control lists, modifies permissions, and blocks the internal DeviceAdd interface so that Microsoft's identification services no longer recognize the computer as a registered device.
After running the script, users may experience partial loss of functionality. During testing, authentication through login.live.com became unavailable in all browsers, while login.microsoftonline.com, online games, and several other applications continued to operate normally. The script cannot remove identifiers that have already been sent to Microsoft.
deGDID is designed exclusively for unmanaged consumer devices. It will refuse to run on corporate or domain-joined systems. Windscribe describes the project as experimental and does not claim it eliminates every trace of the Global Device Identifier.
