Research and practical hardening for Microsoft’sGlobal Device Identifier (GDID), a server-assigned installation identifier that Windows can acquire even when the interactive user has only a local account.
The repository documents the wider GDID lifecycle. The shippeddegdid.ps1has a narrower operational objective:
On a supported Windows target, remove real server-issued GDID state from the known local stores and keep the DeviceAdd path continuously blocked.
That is a GDID completion gate. It is not a general telemetry, browser-privacy, or court-record-channel suppression claim.
GDID is a server-assigned 64-bit Device PUID that Windows can mint through
Microsoft’s DeviceAdd infrastructure and retain across several local identity
stores. A local Windows account does not prevent that machine-level mint.
Court reporting in 2026 established that Microsoft held a GDID-to-URL/time/IP
association in one investigation. The public record does not identify the Windows
component or network channel responsible; this tool makes no claim to block that
unknown channel.
The mutation path is designed for an unmanaged personal Windows installation with
one loaded human profile:
Windows 11 25H2/build 26200 is the fully lab-validated line. Other accepted builds
warn. Managed systems, ambiguous users, and multiple loaded human profiles are
refused instead of guessed at.
Status can still inspect unsupported systems. See theusage guidefor the complete eligibility rules.
ProtectedNoRealGdidis the only complete result. Re-run Status after major Windows,
firewall, security-product, or hosts-file changes.
To remove degdid’s network controls:
Unblock allows Windows to mint a real GDID again. See theusage and CLI referencefor every command, verdict, exit code,
DryRun behavior, pre-first-online setup, and recovery details.