A fourth flag, –Unprotect , allows you to reverse the script in case you need to revert back to the default state. But –Protect is the one worth discussing. First, the script looks for server-issued GDID keys in the registry, where they remain cached, and purges them all. This is something you can do manually as well. In fact, Windscribe tried it on a virtual machine, but the GDID keys are silently re-minted in the background upon a reboot or whenever Windows contacts Microsoft servers again.
To close this loop, the script then modifies the ACLs (Access Control Lists) and registry permissions to prevent the OS from fetching and subsequently trying to remint the GDID keys. It puts up a firewall against the internal DeviceAdd endpoint, which completely cuts off Microsoft identity services from even seeing this as a registered Windows PC. This one-two punch completes the process, and the existing GDID keys are not only wiped, but the possibility of new ones being created is put to bed as well.
Keep in mind that old keys that are already server-side cannot be removed; Microsoft has access to them indefinitely. This script also only works on unmanaged systems with admin accounts. If you're part of an organization or domain, deGDID will refuse to run. More importantly, though, since it blocks Microsoft's DeviceAdd pipeline, some core Windows services will break because they'll fail to authenticate your Microsoft account.
Arrest and extradition of Scattered Spider hacker shines light on how Windows telemetry GDIDs can identify and track users
Microsoft's GitHub bans security researcher who posted zero-day Windows exploits because company ruined their life
Windows 11 identifier used to track Scattered Spider perp after Microsoft shared info with FBI
The reason deGDID is even needed in the first place is that Windows has no native toggle to turn off GDID. It exists as a permanent device ID that can track you without your consent. It works across IP addresses since it sits beneath the layer where VPNs operate, so no amount of network tunneling can obfuscate it. This can explain why Windscribe was compelled to create deGDID — to combat a potentially invasive system that has the power to wreak havoc in the wrong hands.
We tried the script on a Windows 11 computer, and it worked as intended. Running the –Status flag showed multiple cached GDIDs that were then removed by the –Protect flag, and a new GDID didn't show up even after restarting. As expected, some Microsoft apps freaked out and returned connection errors. Account verification through login.live.com was also blocked across all browsers, though login.microsoftonline.com still worked. Online games and other apps continued to behave normally as well.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/software/windows/SPONSORED_LINK_URL
- https://www.tomshardware.com/software/windows/vpn-provider-windscribe-has-built-a-script-to-block-microsofts-persistent-gdid-tracking-on-windows-degdid-erases-existing-identifiers-and-blocks-new-ones-from-being-created#main
- https://www.tomshardware.com/membership
- Introducing Bench 2.0 — a revamped benchmark analyzer, exclusively for Tom's Hardware Premium subscribers
- At AI Summit, South Korea Outlines Its AI Future With NVIDIA and Partners
- Rogue OpenAI models behind 'unprecedented cybersecurity incident' teamed up to break out of their testing environment — multiple agents left each other messages
- Nvidia sells RTX 50-series GPUs at MSRP during QuakeCon 2026 — graphics cards sold at launch prices more than a year after release are now considered an attract
- AMD doubles data center revenue year over year, but gaming revenue plunged by 31% — CEO Lisa Su says prices have 'weighed on' consumer demand but is 'optimistic
Informational only. No financial advice. Do your own research.