Windows GDID: Reverse Engineering Microsoft's Global Device Identifier

Microsoft's Global Device Identifier (GDID) has been a topic of intense speculation since it appeared in a July 2026 federal complaint against a Scattered Spider suspect. The viral narrative claimed it was a 128-bit identifier derived from hardware serials. The reality is both simpler and more interesting.

What the Court Actually Said

The complaint in United States v. Peter Stokes describes the GDID as a persistent, device-level identifier tied to a Windows installation. The value cited — g:6755467234350028 — is a 64-bit decimal integer, not 128-bit. Crucially, the affidavit notes that a reinstall of Windows produces a new GDID, which rules out any derivation from fixed hardware serials.

Where GDID Surfaces

Microsoft's public Azure Monitor documentation defines a GlobalDeviceId column in the UCDOStatus table for Delivery Optimization. But Delivery Optimization only reports the value; it doesn't own it. The real owner is the Connected Devices Platform (CDP).

The Stack Behind GDID

The GDID is essentially a Microsoft Account Device PUID — a 64-bit Passport Unique ID. The chain works like this:

• wlidsvc (Microsoft Account service) provisions the device with login.live.com and retrieves a device PUID.
• That PUID is stored in the registry.
• The Connected Devices Platform (cdp.dll / CDPSvc) reads it and registers it into the Device Directory Service (DDS) graph.
• Delivery Optimization then reports it as GlobalDeviceId.

This was all reproduced on a live Windows 11 (26200) machine using public symbols. The value is stored in a single registry key, and you can find your own GDID with one read.

Debunking the Myths

The viral claim that GDID is a 128-bit identifier generated from serial numbers is false on both counts. The value is 64-bit, and a reinstall changes it — something that wouldn't happen if it were derived from fixed hardware. The author also notes that even without a Microsoft Account, CDP uses an anonymous device path, so a local account doesn't prevent a GDID.

Reducing Exposure

For those concerned about privacy, the writeup suggests that using a local account and disabling CDP services can reduce the identifier's persistence, though the exact steps are left to the reader's discretion.

This is a solid piece of reverse engineering that cuts through the noise and gives engineers a clear, reproducible understanding of how Windows telemetry actually works.