Microsoft confirms every Windows PC is trackable and how it can lead to your arrest

Microsoft has confirmed that Windows installations include what is called a Global Device ID (GDID), a persistent, unremovable identifier that links a user to a specific Windows installation. This so-called GDID was a revelation that emerged as a byproduct of Microsoft assisting authorities in catching a cybercriminal, as Microsoft provided the GDID to authorities to help identify a suspect.

2

The GDID is assigned during setup or sign-in to a Microsoft account, remains even after updates, and cannot be edited or changed. It is stored in the Windows registry and on Microsoft's server side, and Microsoft has shown it's capable of identifying a user based purely on the GDID activity it can see on its server side.

For example, the cybercriminal was a 19-year-old who arrived at Helsinki airport in April 2026, where he was trying to board a plane to Japan. Before he could board the flight, he was stopped by Finnish police, and US prosecutors later revealed he was Peter Stokes, an alleged member of the Scattered Spider hacking group responsible for an $8 million ransom. Microsoft assisted the FBI in tracing Stokes, providing the authorities with a means of tracking Stokes' Windows PC across VPNs, proxy servers, and three countries - GDID.

"A persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device, either a physical device (e.g., a mobile phone or laptop) or virtual machine, across certain Microsoft services and scenarios," said a Microsoft representative describing the GDID

Microsoft was able to take all of Stokes' on-device activities, and when it spotted a pattern of behavior on its GDID system that matched Stokes' behavioral pattern, Microsoft notified authorities and provided them with his identity, eventually leading to his arrest. While Microsoft doesn't explicitly state that literally every Windows installation has a GDID attached to it, it is safe to say that each modern Windows installation, which includes both Windows 10 and Windows 11, can be assigned its own GDID once it connects to relevant Microsoft services.

Frequently Asked Questions

TweakBot answers common questions about this news using TweakTown's own coverage from this page and related content from our archive. Tap a question to reveal the answer, or type your own below.

Question #1

Under what circumstances is a Windows installation assigned a GDID during setup or sign-in?

The article states a GDID is assigned during setup or when signing in to a Microsoft account. It also notes a modern Windows installation (Windows 10 or Windows 11) can be assigned a GDID once it connects to relevant Microsoft services.

Answered

Question #2

Can the GDID be removed, edited, or changed by a user or through Windows settings?

No. The article states the Global Device ID is a persistent, unremovable identifier assigned during setup or sign-in, remains after updates, and cannot be edited or changed. It is stored in the Windows registry and on Microsofts server side, allowing Microsoft to identify a user based on GDID activity.

Answered

Question #3

How did Microsoft use the GDID to help authorities identify and track the accused cybercriminal in the Helsinki case?

Microsoft provided the accused's Global Device ID (GDID) to authorities, which allowed them to track his Windows PC across VPNs, proxy servers, and three countries. Microsoft matched on-device activity patterns it saw tied to that GDID against behavior in its server-side GDID system, notified authorities when patterns matched, and provided the suspect's identity, leading to his arrest.

Answered

Question #4

Does the GDID persist across OS updates, reboots, and network changes such as VPNs or proxies?

The article states the GDID "remains even after updates" and "cannot be edited or changed," and it is stored in the Windows registry and on Microsoft’s servers. Microsoft used the GDID to track a device across VPNs and proxy servers and across multiple countries. The article does not state whether the GDID persists specifically across reboots.

Answered

Have a question not listed here? Ask below and TweakBot will answer it.

Your questionAsk

Answering your question×

TweakBot is analyzing your question…

Could not get an answer

TweakBot is generating an answer

Read More

Was TweakBot helpful?Thanks for the feedback!

So, how many machines do you think that is?