smtimesiwndr/gdid-reversal

This repository is not a piece of software you install, it is a detailed research writeup explaining how a Windows identifier called the Global Device Identifier, or GDID, is actually generated, stored, and sent by Microsoft. The GDID became publicly notable because it appeared in a real United States federal criminal complaint from July 2026 against an alleged member of a hacking group, where investigators used it to help tie online activity to a specific device. The author explains that after that court document became public, a viral social media summary made two incorrect claims about the GDID, saying it was a 128 bit number generated from hardware serial numbers. The author walks through why both claims are wrong, pointing out that the actual value in the court document fits into 64 bits, and that the court filing itself states a Windows reinstall produces a brand new GDID, which would not happen if it were derived from fixed hardware serial numbers. The bulk of the writeup traces where the identifier actually comes from, using public Microsoft documentation, publicly available debugging symbols, and the author's own testing on a real Windows 11 machine. It follows the identifier from a Windows subsystem called the Connected Devices Platform, through Microsoft's cross device identity system, back to its true source, a Microsoft Account device registration service that mints the identifier when a Windows installation first registers with a Microsoft Account. The author also revisits and corrects an earlier claim in the same document, noting that even local Windows accounts without a Microsoft Account can still end up with a GDID through an anonymous device registration path. Every claim throughout the document is labeled with a confidence tag showing whether it comes directly from the court filing, was directly observed on a test machine, was proven by examining Windows system files, or is a reasonable inference. The writeup also includes a short section showing readers how to find their own device's GDID value through a single registry lookup, along with a section discussing ways to reduce this kind of tracking exposure.