VPN provider built a script to block Microsoft's hidden GDID tracking on Windows — Windscribe's "deGDID" erases existing identifiers and blocks new ones from being created

(Image credit: Microsoft)

Last month, we covered a federal criminal case in which Microsoft's Global Device Identifier (GDID) helped the FBI catch an alleged hacker. Despite the noble cause, the implications of a persistent tracker built into Windows became difficult to ignore, and it was enough of a tipping point to convince Windscribe to do something about it. The VPN company has created an open-source project and script called "deGDID" that aims to strip GDID off your PC — but does so at the cost of breaking some Microsoft cloud services.Go deeper with TH Premium: CPUYou can find the script on GitHub and run it via PowerShell with admin privileges. It's completely free and works in a very straightforward manner. There are three main execution flags that dictate how deGDID operates: –Status, which is read-only and tells you if a GDID is active on your rig; –Status –Redact, which generates logs with the GDID redacted so users can share diagnostic data more confidently; and –Protect, which completely wipes the GDID and prevents the creation of new ones.

Image 1 of 2

(Image credit: Future)

A fourth flag, –Unprotect, allows you to reverse the script in case you need to revert back to the default state. But –Protect is the one worth discussing. First, the script looks for server-issued GDID keys in the registry, where they remain cached, and purges them all. This is something you can do manually as well. In fact, Windscribe tried it on a virtual machine, but the GDID keys are silently re-minted in the background upon a reboot or whenever Windows contacts Microsoft servers again.To close this loop, the script then modifies the ACLs (Access Control Lists) and registry permissions to prevent the OS from fetching and subsequently trying to remint the GDID keys. It puts up a firewall against the internal DeviceAdd endpoint, which completely cuts off Microsoft identity services from even seeing this as a registered Windows PC. This one-two punch completes the process, and the existing GDID keys are not only wiped, but the possibility of new ones being created is put to bed as well.