GoKawiilFull writeup of the Windows GDID Global Device Identifier fully reverse engineered How Microsoft's "Global Device Identifier", the persistent Windows fingerprint named in the July 2026 Scattered Spider complaint, is actually generated, stored, and transmitted.
Note Listed below is true, but missing some information. Regardless of being logged in with a MSA you WILL have a GDID. I didn't realize this at the time of posting but I looked into it. CDP has an anonymous device path that is used if no MSA has been connected. The underlying system is still factually correct just missing a few things.
GDID is a real telemetry item. It shows up in the U.S. federal criminal complaint (United States v. Peter Stokes, N.D. Ill., July 2026) as Global Device Identifier g:6755467234350028 .
It shows up in the U.S. federal criminal complaint (United States v. Peter Stokes, N.D. Ill., July 2026) as . It is a Microsoft Account "Device PUID". A 64 bit Passport Unique ID assigned to a Windows installation when it registers with a Microsoft Account, written in the device graph as g:<decimal> .
A 64 bit Passport Unique ID assigned to a Windows installation when it registers with a Microsoft Account, written in the device graph as . The claims are wrong. It is not "128 bit" and not "generated from serial numbers." The court record itself says a reinstall produces a new GDID, which rules out it being derived from hardware serials like your GPU.
It is "128 bit" and "generated from serial numbers." The court record itself says a reinstall produces a new GDID, which rules out it being derived from hardware serials like your GPU. The stack, bottom to top: wlidsvc (Microsoft Account service) provisions the device with login.live.com and gets back a device PUID -> stores it in the registry -> the Connected Devices Platform ( cdp.dll / CDPSvc ) reads it and registers it into the Device Directory Service (DDS) graph -> Delivery Optimization reports it as the documented UCDOStatus.GlobalDeviceId .
(Microsoft Account service) provisions the device with and gets back a device PUID -> stores it in the registry -> the Connected Devices Platform ( / ) reads it and registers it into the graph -> Delivery Optimization reports it as the documented . All of it was reproduced on a live Windows 11 (26200) machine with public symbols. You can find your own GDID in one registry read (§7).
Note Confidence labelling. Every claim is tagged so you can weigh each one yourself: [COURT] primary source fact, [OBSERVED] reproduced live on my test machine, [STATIC] proven from binaries and public Windows PDBs, [ASSESSED] strong inference from the evidence.
Contents
1. Background: what the court actually said
... continue reading