GDID Windows – Cut the tracker that follows you even under VPN

Summary

As I mentioned earlier, in April 2026, the FBI caught an alleged Scattered Spider member. The guy was hiding his traffic behind a VPN, with IPs across three different countries. And guess what? It wasn't a wrong move that gave him away - it was an identifier that your Windows carries 24/7 and that Microsoft hands over to authorities when asked: the GDID. I've already talked about it in this article , and after writing it, I started wondering whether we could get rid of it.So I spun up a small Windows 11 Pro VM and dug in with the help of my favorite LLM - here's what I found. What works, and especially what doesn't work at all, you'll see.First, you need to understand what the GDID actually is. It's not your motherboard's serial number, it's not a hash tied to your hardware. No - it's a 64-bit PUID, meaning an identifier that Microsoft's servers attach to your account the moment you open a Windows session. It's written in plain text in your registry, your machine registers it in a directory on Microsoft's side, and a service quietly sends it back up when needed. And if you change your IP with a VPN, it doesn't care. The GDID doesn't budge one bit.Look your own tracker in the faceLet's start by seeing it with our own eyes. Open a PowerShell and paste this:$lid=(Get-ItemProperty 'HKCU:SOFTWAREMicrosoftIdentityCRLExtendedProperties').LID "g:$([Convert]::ToUInt64($lid,16))" On my VM, it spat out g:6755487812206045. That's the one Microsoft can tie to everything I do. (In theory, mind you, because this is the code associated with my VM, so I don't care - which is why I'm showing it to you.)You just read the label that's been stuck on your back.Delete it? Forget itBasic reflex: delete the key from the registry at HKCU:SOFTWAREMicrosoftIdentityCRLExtendedProperties and boom, no more tracker. That's what I tried first… I wiped the value, restarted the service that handles it, and nothing. Done? Nope. I opened the Microsoft Store for two seconds, and the GDID came back. Not ...