Millions of Windows computers around the world, including laptops used daily in Kenya, contain a permanent digital identifier that many users have never heard of.
Known as the Global Device ID (GDID), the identifier is automatically created when Windows is installed and remains tied to the computer for its entire lifetime.
GDID attracted public attention after Microsoft referenced it in a legal complaint related to an investigation into an alleged member of Scattered Spider, a loosely organised cybercrime group known for targeting major organisations through sophisticated social engineering attacks.
Scattered Spider is not linked to any government and is believed to comprise primarily young, English-speaking hackers from the United States and the United Kingdom, although law enforcement agencies have arrested suspects in several countries.
The group specialises in manipulating IT help desks and employees into granting access to corporate systems.
Once inside, its members are accused of stealing sensitive data, extorting victims and, in some cases, deploying ransomware. The group has been linked to cyberattacks targeting organisations in the telecommunications, retail, technology, aviation, insurance and casino industries.
According to the court filing, the GDID is automatically assigned to each Windows installation and is designed to persist throughout the device's lifetime, allowing Microsoft to distinguish one Windows installation from another across supported services.
The identifier became a focus of discussion after reports indicated Microsoft used historical records associated with the GDID, alongside other technical data, to help investigators link activity to a specific Windows installation.
However, the complaint did not suggest that the GDID bypasses encryption, virtual private networks (VPNs) or other privacy tools. Nor did Microsoft describe the identifier as a tool for monitoring everything users do on their computers. Instead, the company says the GDID is intended for security-related purposes and is not used for advertising or tracking users across apps and websites.
For many Windows users, the revelation has raised an important question: Can Microsoft, or anyone else, track your computer using this permanent ID, even if you use a VPN?
What is Microsoft's Global Device ID?
According to Microsoft, the Global Device ID (GDID) is a unique identifier assigned to every Windows installation.
Unlike your computer's name, IP address or advertising ID, the GDID is designed to remain permanently associated with the device.
Microsoft says the identifier helps Windows recognise a device securely and supports security-related functions, particularly when communicating with Microsoft's cloud services.
The company maintains that the identifier is not intended for advertising, profiling or tracking users across apps and websites.
Why was it suddenly revealed?
The GDID has existed within Windows for years but attracted little public attention.
Following questions from researchers and privacy advocates, Microsoft on Thursday confirmed that the GDID is a legitimate Windows feature and explained its intended purpose.
Can you turn it off?
Unlike Microsoft's advertising ID, which users can disable through Windows privacy settings, the GDID cannot be reset or switched off.
Microsoft says this is intentional, because the identifier is used for device security rather than advertising; allowing users to change it would undermine its reliability.
The identifier therefore remains tied to the device throughout its operational life.
Does it mean Microsoft can track everything you do? Not necessarily. A common misconception is that a permanent device identifier automatically allows someone to monitor everything a user does online.
Privacy experts say that is not how the GDID works. The identifier itself does not reveal:
Your browsing history.
Your files.
Your location.
Your passwords.
Your messages.
The websites you visit.
Instead, it acts more like a permanent serial number that software and services can use to recognise a specific device.
Whether it can be linked to a person's activity depends on how it is used by the operating system or applications.
Microsoft says it uses the identifier only for security-related purposes.
Does a VPN hide the GDID?
One of the biggest questions following the disclosure is whether using a Virtual Private Network (VPN) prevents the identifier from being seen.
The answer is no. A VPN encrypts your internet traffic and hides your public IP address from websites and internet service providers.
However, it does not remove or alter identifiers built into your operating system.
If Windows or Microsoft software communicates with Microsoft's servers as part of legitimate security or device-management processes, the GDID can still identify that particular computer regardless of whether the internet connection passes through a VPN.
In other words, a VPN hides where your internet traffic appears to come from while the GDID identifies which device is communicating. The two serve entirely different purposes.
Modern computers already contain several unique identifiers, including:
MAC addresses for network adapters.
Motherboard serial numbers.
Storage drive serial numbers.
TPM (Trusted Platform Module) identifiers.
BIOS or UEFI serial numbers.
The GDID is another device identifier created specifically by Windows. Unlike a MAC address, which can sometimes be changed or hidden, Microsoft says the GDID is designed to remain permanent.
Should Kenyan users be worried?
For most Windows users, cybersecurity experts say there is no immediate reason for alarm.
Permanent identifiers are common across modern technology. Android phones, iPhones, gaming consoles, smart TVs and enterprise computers all use various hardware or software identifiers to improve security, licensing and fraud prevention.
However, privacy advocates argue that greater transparency is important whenever operating systems include identifiers that users cannot disable.
Like most major technology companies, Microsoft can disclose certain user information or device-related records when required to do so under valid legal processes, such as court orders, subpoenas or law enforcement requests.
The recent Scattered Spider case illustrates how device identifiers and historical account records may be used as part of a criminal investigation, rather than for routine monitoring of users.
The disclosure has also prompted some users to question whether switching to Apple's Mac computers would offer greater privacy. However, cybersecurity experts note that changing operating systems does not eliminate device identifiers.
macOS devices, like Windows PCs, contain unique hardware and software identifiers used for security, device management and services such as Apple's Find My network. The key difference lies in how each company manages and discloses information about those identifiers, rather than whether such identifiers exist at all.
But if you are looking for a system that is completely invisible to its manufacturer, neither Windows nor macOS is designed for that. Both platforms are built for cloud-connected experiences that require unique device identification to function. If total anonymity is the goal, users typically turn to hardened versions of Linux or specialised privacy-focused operating systems.
Why Microsoft uses permanent Device IDs
Microsoft says permanent device identifiers help support several security functions, including:
Detecting compromised devices.
Preventing fraud.
Improving device authentication.
Strengthening enterprise security.
Protecting Microsoft accounts from abuse.
The company stresses that the GDID is not an advertising identifier and is not used to track users across websites or applications.
The disclosure of the GDID has renewed discussion about transparency in modern operating systems.
As computers become more connected through cloud services and artificial intelligence, experts say users increasingly want to know what identifiers exist on their devices and how they are used.
Comments
Sign in with Google to comment, reply, and like comments.
Continue with Google