The Windows GDID
(Global Device Identifier)

The GDID is a persistent, device-level identifier that Windows assigns to your installation. It stays fixed across OS updates, and a VPN does nothing to hide it — because it's stored locally and reported by the operating system itself, not by your network. This page explains what it is, where it lives, and how to find yours.

What is the GDID?

A Global Device Identifier is a persistent, device-level identifier designed to uniquely identify an installation of Windows — on a physical device or a virtual machine — across certain Microsoft services and scenarios. Technically it's a 64-bit Microsoft Account "Device PUID" that is assigned by Microsoft's servers (login.live.com) during setup and then stored in your registry.

Importantly, it isn't tied to whether you sign in with a Microsoft Account. The Connected Devices Platform [the Windows service that syncs your device to Microsoft's device graph] has an anonymous device path that provisions an identifier even without an account. In practice: if you're running Windows, you have one.

Where it lives

The identifier is stored in the current-user registry hive, under the IdentityCRL extended properties:

How to find yours

Open PowerShell and run the command below. It reads the IdentityCRL extended properties on your machine [a read-only lookup — it does not change anything]:

# Read the IdentityCRL extended properties (where the GDID/LID lives)
Get-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties" -ErrorAction SilentlyContinue | Format-List

If the key exists, you'll see a LID value among the properties — that's your device identifier. The exact fields present can vary between machines and Windows versions; on some systems the key may be empty or absent, which simply means the identifier is provisioned through a different path.

Why a VPN doesn't hide it

This is the part that surprises people. A VPN masks your network exit point — the public IP address anyone watching your traffic would see. But it has no effect on what the operating system itself already knows and stores. The GDID sits above the network layer, as a constant thread that ties your sessions together.

So the moment your real identity is ever exposed even once — the VPN drops, a connection leaks, or you sign into a personal account — that event can be correlated back to the same device identifier. The IP rotates; the GDID doesn't rotate with it.

How to reduce your exposure

You can't casually delete the GDID, but you can shrink the surrounding telemetry footprint. Standard, legitimate privacy hygiene:

• Minimize diagnostic data: Settings → Privacy & security → Diagnostics & feedback → turn off optional diagnostic data. This reduces what gets sent, though it doesn't remove the identifier.
• Separate your identities: don't sign into personal accounts from an environment you want kept isolated — correlation between accounts is what does the damage.
• Use a dedicated or amnesiac system for sensitive work — privacy-focused Linux live systems don't generate persistent Windows identifiers between reboots.
• Remember anonymity is a system, not a switch: a VPN is one layer, and a single layer is rarely enough on its own.