Windows 10: Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in...

Microsoft has publicly acknowledged the existence of the Global Device Identifier (GDID), a device-specific ID assigned to Windows installations, in a federal complaint filed by US prosecutors against an alleged member of the Scattered Spider hacking group.

The ID is generated when Windows is set up with a Microsoft Account, persists through Windows updates, and cannot be disabled without affecting Windows activation and Microsoft Store apps.

Microsoft briefly mentioned GDID in the Azure Monitor documentation, describing it only as "an identifier used by Microsoft internally." The complaint cites a Microsoft representative describing GDID as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device, either a physical device such as a mobile phone or laptop or a virtual machine, across certain Microsoft services and scenarios."

What the Windows Global Device Identifier Is and How the FBI Used It


The Global Device Identifier (GDID) is a permanent ID assigned when Windows provisions against a Microsoft Account. It is generated by a chain of Windows services.

The wlidsvc service requests a Device PUID from login.live.com, which is then registered into Microsoft's Device Directory Service by the Connected Devices Platform.

Delivery Optimization reports the GDID back to Microsoft when the PC shares or downloads updates. This identifier is stored in the Windows registry under HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties and formatted with a lowercase "g" prefix followed by a decimal number.

It is reported to Microsoft servers and remains persistent across Windows updates, but it is not retained after a clean reinstall. Microsoft has acknowledged that one user can have multiple GDIDs linked through their account, OneDrive, and activation history.

The FBI used the GDID to track Peter Stokes, alleged member of Scattered Spider, across VPN connections, proxy servers, and through four countries over roughly eight months.

According to the complaint, the GDID g:6755467234350028 was recorded visiting the ngrok signup page at the same time an account used in the attack was created via a Tzulo VPN proxy. Three hours later, the same GDID accessed a victim retailer's website through the same proxy.

The device was cross-referenced with IP addresses linked to Stokes's accounts on Snapchat, Facebook, Apple, and Ubisoft across Estonia, New York, Thailand, and other locations. Stokes's public Snapchat photos matched hotel bookings, locations, and travel timelines associated with the GDID.

The persistent nature of the GDID across VPN sessions proved a key investigative asset. While VPN IP addresses change frequently, the underlying Windows installation continued reporting the same identifier, aiding investigators in their tracking efforts.

Why Privacy Researchers Are Concerned and What Users Can Do


Multiple security researchers have raised concerns about the visibility and control users have over GDID:

• There is no consent screen when GDID is assigned. Apple's advertising identifier requires an App Tracking Transparency prompt with a visible reset. Android provides similar controls. GDID has neither.
• Activation dependence. Massgrave, the group behind Microsoft Activation Scripts, has noted that Windows setup sends hardware info to Microsoft and receives identifiers back that are later used for Store access and licensing. Blocking GDID assignment breaks both activation and UWP apps.
• Reinstalling Windows produces a new GDID, but signing back into the same Microsoft Account gives Microsoft a clear path to link the new identifier to previous activity.
• Microsoft's public documentation of the identifier consists of one sentence in an Azure Monitor reference table for enterprise IT administrators.

Security researcher Matthew Hickey has characterized Windows as "surveillance software" in response to the case. Costin Raiu asked on the Three Buddy Problem podcast how much similar functionality exists on other platforms.

Users concerned about GDID have limited direct options because the identifier cannot be turned off without breaking core Windows functionality. Practical steps that reduce related tracking include:

1. Use a local account instead of a Microsoft Account when possible. Windows 11 has made this harder in recent versions, but the option is still available during setup for users who know how to reach it.
2. Turn off optional diagnostic data through Settings, Privacy and security, Diagnostics and feedback.
3. Disable personalized ads and launch tracking under Privacy and security, Recommendations and offers.
4. Turn off Cloud Content Search under Privacy and security, Search, to stop local searches from sending data to Bing.
5. Review and disable Activity History and other telemetry options in Privacy and security settings.
6. For journalism, activism, or domestic abuse situations where identifier persistence poses a threat, use Linux routed through Tor rather than relying on a commercial VPN with a Windows PC.

Users who reinstall Windows to obtain a new GDID should be aware that signing back into the same Microsoft Account provides Microsoft with data linking the new identifier to previous activity.

What GDID Means for Windows Users and How Widely It’s Deployed


For the approximately 1.6 billion Windows users worldwide, GDID has been operating quietly in the background without any public disclosure or user controls. The recent complaint revealed the existence of this identifier, but Microsoft has not committed to providing user-facing controls or documentation for regular users.

Users concerned about device-level tracking should be aware that the identifier is attached to the account, not the device, meaning reinstalling the OS does not break the link.

Most major operating systems maintain some form of persistent device identity for purposes like licensing and security checks, but Windows differs from platforms like Apple and Google by not offering visible controls.

Legal requests, such as subpoenas, can compel Microsoft to share GDID activity data with law enforcement, as exemplified by the Scattered Spider case. GDID is present on all Windows installations linked to a Microsoft Account.

Users cannot view their own GDID through standard Windows interfaces; it is stored in the registry at HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties under the LID key. Microsoft has not indicated any changes to how GDID is generated, stored, or reported.

The only public reference outside of the federal complaint is a brief note in Azure Monitor documentation. Users can monitor Microsoft's privacy updates, but the company has not signaled plans to provide more public information about GDID.

The Scattered Spider case is progressing through the US federal court system. For those interested in the technical details, reviewing the complaint's discussion of Microsoft telemetry offers the clearest public explanation of how GDID operates to date.

Thank you for being a Ghacks reader. The post Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing appeared first on gHacks.

read more...

 

Disabling Synaptic touchpad in Windows 10, and why it won't stay disabled. For a left handed person, it is disruptive.

Hi,

If you wish to disable your touchpad, I suggest you to follow the steps mentioned below.

• Press Windows Key +X.
• Select Device manager.
• Expand Mice and other pointing devices.
• Right click on Synaptic touchpad driver and select Disable.
• Click OK to confirm and check with the issue.

Please reply us with the status to assist you further.

 

Microsoft signals end of Paint program

Microsoft has confirmed that it will continue to offer its graphics program Paint.

In a recent update, it had listed Paint as a feature that would be either removed or no longer developed.

Paint, renowned for its simplicity, has been part of the Windows operating system since its launch in 1985.

Microsoft suggested it would not remain on Windows 10 by default but did say it would be available for free on the Windows Store.

BBC news Report here
http://www.bbc.co.uk/news/technology-40714395

 

Disabling Microsoft Device Association Root Enumerator in Win11

Thank you very much for reaching out! As an Independent Advisor and fellow Microsoft user, I'm more than happy to assist you.

If the "Microsoft Device Association Root Enumerator" is greyed out in Device Manager, it typically means that the device is not currently active or in use, which can prevent you from disabling it directly through the usual method. Here are some steps you can take to address this issue:

1. Check for Administrative Privileges:
   Ensure you are logged in with an account that has administrative privileges. Sometimes, certain actions in Device Manager require admin rights.
   
2. Update or Uninstall the Driver:
   Since the disable option is greyed out, you can try updating or uninstalling the driver:
   
   • Update: Right-click on the "Microsoft Device Association Root Enumerator" and select "Update driver." Follow the prompts to see if there is an update available.
     
   • Uninstall: Right-click on the "Microsoft Device Association Root Enumerator" and select "Uninstall device." Confirm the action. After uninstalling, restart your computer. Windows will typically reinstall the necessary drivers upon reboot.
     
3. Use Device Manager in Safe Mode:
   Boot your computer into Safe Mode and try disabling the device from there. Safe Mode loads a minimal set of drivers and might allow you to disable the device:
   
   • Restart your computer and press F8 (or Shift + F8) before Windows starts to load.
     
   • Select "Safe Mode" from the boot options menu.
     
   • Open Device Manager and try to disable the "Microsoft Device Association Root Enumerator."
     
4. Check for System Updates:
   Ensure your Windows 11 system is fully updated. Sometimes, system updates can resolve issues with device drivers.
   
5. Use Command Prompt:
   You can try using the Command Prompt to disable the device:
   
   • Open Command Prompt as an administrator.
     
   • Use the following command to list all devices:
     
     
   • Find the "Microsoft Device Association Root Enumerator" in the list and note its instance ID.
     
   • Use the following command to disable the device:
     
     
   Replace "Instance ID" with the actual instance ID of the device.
   

If none of these methods work, it might indicate that the device is not installed or not functioning correctly. In such cases, you might not need to disable it as it is not actively affecting your system.

Please feel free to reach out if you require any additional assistance. I'm here to help!