Windows Tracks You With a Hidden ID. So We Built deGDID to Block It.

What do you think about this?
Yes or No

What protection does​

At a high level, deGDID does two things:

1. Blocks known Microsoft registration paths by managing a region in the Windows hosts file, plus reinforcing the block with Windows Firewall rules.
2. Wipes known local GDID-related state across target-user, SYSTEM, and .DEFAULT identity locations, token device IDs, device tickets, Credential Manager entries, ConnectedDevicesPlatform, TokenBroker, WAM broker caches, and matching NegativeCache entries.

The tool is intentionally conservative. It refuses managed, domain-joined, Entra-joined, MDM-enrolled, or ambiguous multi-profile systems. It requires admin rights, it backs up what it touches, and it supports undo using .\degdid.ps1 -Unprotect.

i did state in another post that the OSC was working on something to stop GDID
the downside at the moment is Microsoft passkeys will not function as intended.

i beleive they are working on that with something like keeping passkeys local
but at the moment its all just in the trail and error stages.

use deGDID at your own risk because i am not sure if its completely reversable.
best of luck Steve ..

XxXxX said:

use deGDID at your own risk because i am not sure if its completely reversable.
best of luck Steve ..

Click to expand...

The good news is that it supports undo, so if you wish to go back and disable deGDID, run .\degdid.ps1 -Unprotect on an elevated Command Prompt, similar to how you would enable it.

Hi, I just tried it out and blocked GDID (I needed to set powershell execution policy to "remote signed" before I could run the powershell script).
Because I observed a contribution from @Shambles Bank in another thread at the same time, I downloaded the Microsoft PC Manager app (through a workaround) despite living in France. It seems that this app "gathers system diagnostics and data via remote servers that do not yet meet strict European Union data handling standards" (from Google IA). Somewhere else Microsoft says that it goes very deep into the system.
I then removed the GDID blocking again (with the .\degdid.ps1 -Unblock cmd) ... and the PC Manager app worked !
Honi soit qui mal y pense !

(I won't test this further because I don't need the PC Manager)

and what happen up on reboot and after connecting to internet... becomes the GDID restored then?

Edit:
first.. MS already have your GDID.. the only way to not have it is to first install windows offline... then after install you can block the domains listed in the script
'login.live.com', 'account.live.com', 'cs.dds.microsoft.com', 'dds.microsoft.com', 'aad.cs.dds.microsoft.com', 'fd.dds.microsoft.com',
'cdpcs.access.microsoft.com', 'ztd.dds.microsoft.com', 'activity.windows.com', 'assets.activity.windows.com', 'edge.activity.windows.com'

but i wonder how good blocking them in the hosts file will do.. as windows do have a neck for bypassing hosts file and also windows firewall.
Also if this subdomains above change or new get added over time.. and when it does a connection will be made and an GDID will be generated.
this is the big problem with sub-domains as hosts file cant handlen wildcards as *.example.com to cover all sub's

My win10 IoT install do not have a GDID.. why.. it never have had a chance to connect to MS.
My solution is to block MS is in my hardware firewall so i can block domains included sub-domains. *.microsoft.com, *.windows.com, *.live.com, *.windowsupdate.com, *.msftncsi.com
i might have some more then this ones, i dont remember now. *lol*

Marie SWE said:

and what happen up on reboot and after connecting to internet... becomes the GDID restored then?

Click to expand...

Hi Marie,
how did you know ?
I restartet twice verifying every time the statuts before. Please see attached the message after restarting and testing the status:

rogerrabbit said:

Hi Marie,
how did you know ?
I restartet twice verifying every time the statuts before. Please see attached the message after restarting and testing the status:

View attachment 178888

Click to expand...

i did an edit on my post. I just glanced the script in the first post as it was 4732 rows long.
i dont see why it needs to be that massive.. so i wonder what more it does then just block a few domains and remove a registry entry... But i dont have the time to read through the whole script.

You're assuming there are not other ways Microsoft tracks and stores this value. I see it being built into other MS products.

You can supposedly block MS domain via DNS, firewall or a router (I do not, because it is used for sync):

neemobeer said:

You're assuming there are not other ways Microsoft tracks and stores this value.

Click to expand...

All tracking is well documented by MS, in order to avoid legal issues for "spying".