Every Windows computer has a permanent ‘Global Device ID’: What users need to know

Millions of Windows computers around the world, including laptops used daily in Kenya, contain a permanent digital identifier that many users have never heard of. Known as the Global Device ID (GDID), the identifier is automatically created when Windows is installed and remains tied to the computer for its entire lifetime. GDID attracted public attention after Microsoft referenced it in a legal complaint related to an investigation into an alleged member of Scattered Spider, a loosely organised cybercrime group known for targeting major organisations through sophisticated social engineering attacks. Scattered Spider is not linked to any government and is believed to comprise primarily young, English-speaking hackers from the United States and the United Kingdom, although law enforcement agencies have arrested suspects in several countries. The group specialises in manipulating IT help desks and employees into granting access to corporate systems. Once inside, its members are accused of stealing sensitive data, extorting victims and, in some cases, deploying ransomware. The group has been linked to cyberattacks targeting organisations in the telecommunications, retail, technology, aviation, insurance and casino industries. According to the court filing, the GDID is automatically assigned to each Windows installation and is designed to persist throughout the device's lifetime, allowing Microsoft to distinguish one Windows installation from another across supported services. The identifier became a focus of discussion after reports indicated Microsoft used historical records associated with the GDID, alongside other technical data, to help investigators link activity to a specific Windows installation. However, the complaint did not suggest that the GDID bypasses encryption, virtual private networks (VPNs) or other privacy tools. Nor did Microsoft describe the identifier as a tool for monitoring everything users do on their computers. Instead, the company says the GDID is intended for security-related purposes and is not used for advertising or tracking users across apps and websites. For many Windows users, the revelation has raised an important question: Can Microsoft, or anyone else, track your computer using this permanent ID, even if you use a VPN? What is Microsoft's Global Device ID? According to Microsoft, the Global Device ID (GDID) is a unique identifier assigned to every Windows installation. Unlike your computer's name, IP address or advertising ID, the GDID is designed to remain permanently associated with the device. Microsoft says the identifier helps Windows recognise a device securely and supports security-related functions, particularly when communicating with Microsoft's cloud services. The company maintains that the identifier is not intended for advertising, profiling or tracking users across apps and websites. Why was it suddenly revealed? The GDID has existed within Windows for years but attracted little public attention. Following questions from researchers and privacy advocates, Microsoft on Thursday confirmed that the GDID is a legitimate Windows feature and explained its intended purpose. Can you turn it off? Unlike Microsoft's advertising ID, which users can disable through Windows privacy settings, the GDID cannot be reset or switched off. Microsoft says this is intentional, because the identifier is used for device security rather than advertising; allowing users to change it would undermine its reliability. The identifier therefore remains tied to the device throughout its operational life. Does it mean Microsoft can track everything you do? Not necessarily. A common misconception is that a permanent device identifier automatically allows someone to monitor everything a user does online. Privacy experts say that is not how the GDID works. The identifier itself does not reveal: Your browsing history. Your files. Your location. Your passwords. Your messages. The websites you visit. Instead, it acts more like a permanent serial number that software and services can use to recognise a specific device. Whether it can be linked to a person's activity depends on how it is used by the operating system or applications. Microsoft says it uses the identifier only for security-related purposes. Does a VPN hide the GDID? One of the biggest questions following the disclosure is whether using a Virtual Private Network (VPN) prevents the identifier from being seen. The answer is no. A VPN encrypts your internet traffic and hides your public IP address from websites and internet service providers. However, it does not remove or alter identifiers built into your operating system. If Windows or Microsoft software communicates with Microsoft's servers as part of legitimate security or device-management processes, the GDID can still identify that particular computer regardless of whether the internet connection passes through a VPN. In other words, a VPN hides where your internet traffic appears to.