Windows 11 users now have an open-source option to limit a persistent device identifier used by the operating system. Windscribe has released a free tool called deGDID for this purpose. The script targets Microsoft’s Global Device Identifier (GDID).
The identifier operates below the network layer. Therefore, VPNs and changes to a device’s IP address do not affect it.
The tool aims to remove the identifier from Windows systems. It also prevents the operating system from generating it again.
What Is deGDID and How Does It Work?
deGDID runs through PowerShell and requires administrator privileges. Users can download the script directly from GitHub.
The tool includes four execution flags. Each flag controls a different part of the process.
The -Status flag performs a read-only check. It identifies whether a GDID is active on the Windows system.
Meanwhile, the -Status -Redact option creates diagnostic logs while hiding the identifier. This allows users to share diagnostic information more safely.
The main protection feature uses the -Protect flag. It removes cached GDID keys from the Windows registry.
The script also changes access control lists and registry permissions. These changes prevent Windows from generating new identifiers.
Additionally, deGDID creates a firewall rule for the internal DeviceAdd endpoint. This prevents Microsoft’s identity services from recognising the computer as registered.
Users can reverse these changes through the -Unprotect flag. This option restores the default Windows settings.
Testing Shows Both Benefits and Drawbacks
Testing on a Windows 11 computer showed that the script worked as described.
The -Status command initially detected several cached identifiers. The tool then removed those identifiers.
After the computer restarted, no new GDID appeared.
However, the testing also revealed important limitations. Account verification through login.live.com stopped working across every tested browser.
Meanwhile, login.microsoftonline.com continued working normally.
Some Microsoft applications also produced connection errors after the identifier was disabled. However, other software continued working normally during testing.
Online games, for example, continued to work during the testing process.
Removing GDID Can Affect Microsoft Services
Users considering deGDID should understand its potential impact on Microsoft services.
Disabling the identifier may cause some Microsoft account functions to stop working. Therefore, users should consider these trade-offs before applying the protection.
The tool also does not replace antivirus or endpoint protection software.
deGDID focuses on the device identifier and tracking concerns. It does not protect computers from malicious software.
Users should consequently continue using appropriate security software on their Windows systems.
Microsoft Can Still Retain Previously Collected Data
Removing GDID from a Windows computer does not erase information already stored by Microsoft.
Windscribe says the tool cannot remove GDID keys already saved on Microsoft’s servers.
As a result, Microsoft can retain data previously collected through the identifier.
The script therefore offers only a partial privacy solution. It cannot erase tracking information that has already reached Microsoft’s systems.
This distinction is important for users seeking complete removal of previously collected data.
Tool Has Limited Compatibility
deGDID also has compatibility restrictions.
The workaround will not run on managed systems or domain-joined accounts. Therefore, it mainly targets individual unmanaged Windows machines.
Windows currently does not provide a built-in option for disabling GDID.
The identifier also remains associated with the system across different IP addresses. Using a VPN does not change that behaviour.
Windscribe explained its testing results in its documentation.
“We tried the script on a Windows 11 computer, and it worked as intended,” Windscribe said in its documentation describing the testing.
deGDID Remains an Ongoing Project
Windscribe describes deGDID as an ongoing research project. The company plans to continue developing the tool as more information becomes available about the identifier’s operation.
For Windows 11 users concerned about device tracking, the tool offers another privacy option. However, its limitations make it different from a complete removal of Microsoft’s existing tracking data.
Users must also consider the potential loss of certain Microsoft account functions.
Therefore, deGDID may reduce future identifier generation while leaving previously collected information untouched. Its impact also depends on which Microsoft services a user relies on.
