A fourth flag, –Unprotect , allows you to reverse the script in case you need to revert back to the default state. But –Protect is the one worth discussing. First, the script looks for server-issued GDID keys in the registry, where they remain cached, and purges them all. This is something you can do manually as well. In fact, Windscribe tried it on a virtual machine, but the GDID keys are silently re-minted in the background upon a reboot or whenever Windows contacts Microsoft servers again.
To close this loop, the script then modifies the ACLs (Access Control Lists) and registry permissions to prevent the OS from fetching and subsequently trying to remint the GDID keys. It puts up a firewall against the internal DeviceAdd endpoint, which completely cuts off Microsoft identity services from even seeing this as a registered Windows PC. This one-two punch completes the process, and the existing GDID keys are not only wiped, but the possibility of new ones being created is put to bed as well.
Keep in mind that old keys that are already server-side cannot be removed; Microsoft has access to them indefinitely. This script also only works on unmanaged systems with admin accounts. If you're part of an organization or domain, deGDID will refuse to run. More importantly, though, since it blocks Microsoft's DeviceAdd pipeline, some core Windows services will break because they'll fail to authenticate your Microsoft account.
Arrest and extradition of Scattered Spider hacker shines light on how Windows telemetry GDIDs can identify and track users
Microsoft's GitHub bans security researcher who posted zero-day Windows exploits because company ruined their life
Windows 11 identifier used to track Scattered Spider perp after Microsoft shared info with FBI
The reason deGDID is even needed in the first place is that Windows has no native toggle to turn off GDID. It exists as a permanent device ID that can track you without your consent. It works across IP addresses since it sits beneath the layer where VPNs operate, so no amount of network tunneling can obfuscate it. This can explain why Windscribe was compelled to create deGDID — to combat a potentially invasive system that has the power to wreak havoc in the wrong hands.
We tried the script on a Windows 11 computer, and it worked as intended. Running the –Status flag showed multiple cached GDIDs that were then removed by the –Protect flag, and a new GDID didn't show up even after restarting. As expected, some Microsoft apps freaked out and returned connection errors. Account verification through login.live.com was also blocked across all browsers, though login.microsoftonline.com still worked. Online games and other apps continued to behave normally as well.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/software/windows/SPONSORED_LINK_URL
- https://www.tomshardware.com/software/windows/vpn-provider-windscribe-has-built-a-script-to-block-microsofts-persistent-gdid-tracking-on-windows-degdid-erases-existing-identifiers-and-blocks-new-ones-from-being-created#main
- https://www.tomshardware.com/membership
- At least 37 people arrested in 2026 so far for protesting against data centers, most for breaking 'petty rules' — most taken into custody acted peacefully
- Microsoft raises European Xbox prices by up to £200 — RAMpocalypse and component shortages force major console markups
- As AI Increases Demands on Memory, Storage Steps Up
- Kioxia and Sandisk demonstrate the world's highest-density 3D NAND flash — 332 active layers and up to 4,800 MT/s interface
- ‘Apple is getting this wrong,’ says OpenAI — startup blasts iPhone maker over lawsuit alleging it stole confidential information through ex-Apple employees
Informational only. No financial advice. Do your own research.