Former Microsoft Engineer Responds to Windows GDID Privacy Concerns

Microsoft’s GDID system has sparked privacy concerns after users discovered that Windows can use the identifier to recognize a specific installation across Microsoft services.

Former Microsoft engineer Dave Plummer responded to a clip discussing the issue with a technical explanation about GUIDs and UUIDs. He correctly noted that modern Windows GUIDs generally cannot reveal or trace a device’s MAC address.

However, the original discussion focused on GDID, not GUID. X Community Notes and several technical users highlighted the difference. Plummer later acknowledged the mistake, explaining that he had reacted before watching the full WAN Show discussion.

GDID is different from a Windows GUID

A GDID is a 64-bit identifier assigned by Microsoft’s servers when Windows connects to the company’s account and device services.

Microsoft has described it as a persistent device-level identifier tied to a particular Windows installation, including installations running inside virtual machines. It may also appear as a Device PUID, or Passport Unique ID.

Unlike a locally generated GUID, Microsoft’s login infrastructure assigns the GDID.

Why Microsoft uses GDID

The identifier supports Windows activation, device licensing, Microsoft Store purchases, application licenses, activation checks, and Delivery Optimization.

During device registration, Windows may send hardware details such as disk, SMBIOS, and TPM information to Microsoft. These details help connect licenses and services to a device’s hardware configuration.

Privacy concerns remain

GDID has legitimate licensing and device-management purposes. However, its persistent nature may allow Microsoft services to associate activity with the same Windows installation across different networks and IP addresses.

This could limit some privacy benefits of using a VPN when Windows continues sending the same identifier to Microsoft services.

Microsoft does not clearly document GDID in consumer-facing Windows materials. Windows Settings also offers no direct option to view, reset, or manage it.

In other news, Microsoft has released a new Windows 11 Insider Preview Build. Separately, the Certighost exploit has been disclosed, and it can compromise Windows domains.

Via Windows Latest