There Is Finally a Way to Kill Microsoft's Windows Tracking, and It Has a Price

There is now a free tool that removes the Windows GDID, the device identifier Microsoft assigns to your installation and which no settings screen lets you turn off. It is called deGDID, it is an open PowerShell script, and it does what it promises. It also breaks your Microsoft account sign-in, the Store, Xbox and OneDrive. That trade is the whole story, and it is the part most coverage skips.

A short reminder of what GDID is

We covered the identifier itself in July, when it surfaced in a US criminal case: Windows GDID, the device tracker that helped catch a hacker. The short version is that when you sign in to Windows with a Microsoft account, Microsoft servers issue a device identifier, Windows stores it, and the Connected Devices Platform registers the machine in Microsoft's directory. Until the complaint against an alleged Scattered Spider member was unsealed on 1 July, Microsoft had published almost nothing about it in public. What made it matter is that investigators received logs correlating that identifier with network activity.

What is new is the countermeasure. Windscribe announced deGDID on 27 July, and the code sits in a public GitHub repository. Russian-language coverage picked it up on 6 August, which is how many readers are only now hearing about it.

What deGDID actually does

The script works in two directions at once, which is why it is more effective than the registry-cleaning tips that circulated earlier:

• It blocks re-issue. Windows fetches a new identifier from a Microsoft endpoint on the live.com domain. deGDID adds entries to the hosts file and backs them with Windows Firewall rules, so the request cannot complete. Without this step, deleting the identifier is pointless, because Windows simply asks for a new one.
• It wipes what is already stored. It clears identity state for the target user, for SYSTEM and for the default profile: token device IDs, device tickets, Credential Manager entries, and the Connected Devices Platform, TokenBroker and WAM broker caches.

It runs from an elevated 64-bit PowerShell session. A read-only mode reports what is present before you change anything, a protect mode does the full routine, and the changes can be reversed. The tool also refuses to run where it could do organisational damage: no domain-joined machines, no Entra or MDM enrolment, no ambiguous multi-profile setups. It targets Windows 10 22H2 and Windows 11 build 22000 or newer.

The price: what stops working

This is the part to read before you run anything. Blocking Microsoft's identity endpoints does not surgically remove one identifier, it cuts a path that several everyday features depend on. The project's own documentation expects breakage in Microsoft account sign-in, Microsoft Store and Xbox authentication, OneDrive sign-in with a Microsoft account, Phone Link, and the device-graph features that let your machines see each other. Windscribe adds passkeys and Windows Hello tied to a Microsoft account to that list. Independent hands-on testing reported exactly this outcome: the script ran cleanly, and then Xbox, Outlook and the Microsoft Store would no longer sign in.

What deGDID does not do

Windscribe is unusually direct about the limits, and they matter more than the feature list. The tool does not erase records Microsoft already holds. Whatever was reported before you ran it stays on their side, and a court order can still reach it. It does not make you anonymous. And it is described by its authors as a research experiment provided as is, to be used at your own risk, not as a product with support behind it.

So the honest framing is narrow: it stops future correlation through this particular identifier on this particular machine. That is worth something, and it is much less than "Windows no longer tracks you".

Softer options if you need your Microsoft account

For most people, losing Store, Xbox and OneDrive is too high a price. There is no setting that disables GDID, but several choices reduce how much is attached to it:

1. Use a local Windows account instead of a Microsoft account. The identifier is issued when you sign in with a Microsoft account, so this is the single biggest lever available without a script.
2. Turn off optional diagnostic data in Settings, under Privacy and security, Diagnostics and feedback.
3. Turn off personalised ads and recommendations in Privacy and security.
4. Turn off cloud search in Privacy and security, so local searches are not sent up.
5. If you do want to try deGDID, run its read-only check first and make sure you can sign back in to anything you depend on before you commit.

It is worth being precise about where a VPN sits in this. A VPN changes the address the network sees, and against most tracking that matters. It does nothing here, because the identifier is not observed on the wire, it is reported from inside your machine by software you are signed into. Rotating your IP does not break a link that Microsoft holds on its own servers, which is exactly what the court filing demonstrated. Channel privacy and device identity are separate problems.

Conclusion